Lucene search
Abhinav Porwal & Hitesh KumarWPEX-ID:A487C7E7-667C-4C92-A427-C43CC13B348DHistoryMay 09, 2022 - 12:00 a.m.
Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting
2022-05-0900:00:00
Abhinav Porwal & Hitesh Kumar
81
form maker
10web
cross-site scripting
stored
admin
exploit
payload.
EPSS
0.001
Percentile
24.8%
The plugin does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
In a form settings, put the following payload in the Actions after submission > Action Type > Custom Text: <img src onerror=alert(/XSS/)>
The XSS will be triggered after a form is submittedRelated
patchstack
patchstack
nvd
nvd
CVE-2022-1564
2022-05-30 09:15:09
cvelist
cvelist
prion
prion
Cross site scripting
2022-05-30 09:15:00
cve
cve
CVE-2022-1564
2022-05-30 09:15:09
wpvulndb
wpvulndb
Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting
2022-05-09 00:00:00