Lucene search
HistoryJul 01, 2024 - 6:15 a.m.
CVE-2024-6130
form maker
wordpress
1.15.26
stored cross-site scripting
settings
high privilege users
admin
unfiltered_html
multisite setup
0.0004 Low
EPSS
Percentile
9.2%
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Related
cve
cve
CVE-2024-6130
2024-07-01 06:15:23
cvelist
cvelist
CVE-2024-6130 Form Maker by 10Web < 1.15.26 - Admin+ Stored XSS
2024-07-01 06:00:01
vulnrichment
vulnrichment
CVE-2024-6130 Form Maker by 10Web < 1.15.26 - Admin+ Stored XSS
2024-07-01 06:00:01
wordfence
wordfence