Unauthorized Execution of Arbitrary Web Scripts through Stored Cross-Site Scripting in VForm Drag & Drop Contact Form Builder

CVE-2024-6770

What is CVE-2024-6770?

The Lifetime free Drag & Drop Contact Form Builder for WordPress, known as VForm, has a vulnerability that allows Stored Cross-Site Scripting (XSS). This issue arises from inadequate input sanitization and a lack of proper output escaping, which presents an opportunity for unauthenticated attackers to inject arbitrary web scripts. These malicious scripts can execute when users visit affected pages, leading to potential data theft, session hijacking, or other harmful actions. Users and web administrators utilizing affected versions are advised to apply patches and updates promptly to fortify their WordPress sites against such exploitation.

References