Lucene search
Asif Nawaz MinhasWPVDB-ID:75305EA8-730B-4CAF-A3C6-CB94ADEE683CHistoryOct 06, 2021 - 12:00 a.m.
Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting
2021-10-0600:00:00
Asif Nawaz Minhas
wpscan.com
12
0.001 Low
EPSS
Percentile
21.6%
The plugin does not sanitise and escape its Form’s Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PoC
Create/edit a form, add the following payload to a Field Label: The XSS will be triggered when viewing/previewing the Form
| CPE | Name | Operator | Version |
|---|---|---|---|
| formidable | lt | 5.0.07 |
Related
nvd
nvd
CVE-2021-24608
2021-10-25 14:15:10
CVE-2021-39330
2021-10-14 16:15:09
cve
cve
CVE-2021-24608
2021-10-25 14:15:10
CVE-2021-39330
2021-10-14 16:15:09
prion
prion
Cross site scripting
2021-10-25 14:15:00
cvelist
cvelist
wpexploit
wpexploit
Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting
2021-10-06 00:00:00
openvas
openvas
WordPress Formidable Forms Builder Plugin < 5.0.07 Multiple Vulnerabilities
2021-11-03 00:00:00