WordPress Plugin Vulnerabilities

FormCraft < 1.2.10 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
formcraft-form-builder
Fixed in 1.2.10

References

CVE
CVE-2023-22717
URL
https://patchstack.com/database/vulnerability/formcraft-form-builder/wordpress-formcraft-contact-form-builder-for-wordpress-plugin-1-2-6-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
01c6bb80-c937-4948-9d1b-3b43916c1bc8

Timeline

Publicly Published
2023-04-19 (about 3 years ago)
Added
2023-05-15 (about 2 years ago)
Last Updated
2024-03-14 (about 2 years ago)

Other

Published
Title
Published
2024-03-12
Title
HT Mega – Absolute Addons For Elementor < 2.4.5 - Contributor+ Stored Cross-Site Scripting via Post Carousel Widget
Published
2023-11-07
Title
Responsive Column Widgets <= 1.2.7 - Reflected XSS
Published
2025-06-18
Title
FastBook <= 1.1 - Reflected Cross-Site Scripting
Published
2025-03-27
Title
Structured Content < 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-05-15
Title
Happy Addons for Elementor < 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget