Stored Cross-Site Scripting Vulnerability in Contact Form Plugin

CVE-2024-9528

Summary

The Fluent Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerabilities due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 5.1.19. Authenticated attackers, typically those with administrative access capable of editing forms, can exploit this weakness by injecting arbitrary web scripts into form label fields. These scripts execute in the context of user sessions when the compromised pages are accessed, posing a significant risk to user data and overall site security.

References