Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-5902

What is CVE-2024-5902?

The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress suffers from a vulnerability that allows for Stored Cross-Site Scripting. This weakness exploits the name parameter due to a lack of proper input sanitization and output escaping. As a result, unauthenticated attackers can inject malicious web scripts into the feedback forms. When these forms are viewed by high-privileged users, the injected scripts execute, posing a significant risk to the integrity and security of the affected WordPress installations.

References