Lucene search

PatchstackVULNRICHMENT:CVE-2021-36821

HistoryMar 16, 2023 - 2:45 p.m.

CVE-2021-36821 WordPress Forminator Plugin <= 1.14.11 is vulnerable to Cross Site Scripting (XSS)

2023-03-1614:45:38

CWE-79

Patchstack

github.com

cve-2021-36821

wpmu dev forminator

cross site scripting

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPMU DEV Forminator – Contact Form, Payment Form & Custom Form Builder allows Stored XSS.This issue affects Forminator – Contact Form, Payment Form & Custom Form Builder: from n/a through 1.14.11.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "forminator",
    "product": "Forminator – Contact Form, Payment Form & Custom Form Builder",
    "vendor": "WPMU DEV",
    "versions": [
      {
        "changes": [
          {
            "at": "1.14.12",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.14.11",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/forminator/wordpress-forminator-plugin-1-14-11-stored-cross-site-scripting-xss-vulnerability?_s_id=cve