Stored Cross-Site Scripting Vulnerability in Fluent Forms Plugin for WordPress
CVE-2024-9651
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 9 December 2024
Badges
What is CVE-2024-9651?
CVE-2024-9651 pertains to a significant security vulnerability identified in the Fluent Forms plugin for WordPress, affecting versions prior to 5.2.1. This vulnerability arises from the lack of proper sanitization and escaping of certain plugin settings, which may enable high privilege users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This is particularly concerning in environments where the 'unfiltered_html' capability is restricted, such as multisite setups. Attackers could exploit this flaw to inject malicious scripts, potentially compromising site integrity and damaging user trust.
Affected Version(s)
Fluent Forms 0 < 5.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.