WordPress Plugin Vulnerabilities
Form Maker < 1.13.60 - Authenticated Stored XSS
Description
The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Proof of Concept
Create or edit a form and add the following payload in the Form Title field "autofocus onmouseover=alert(/XSS/)// save it and move the mouse over the Title field Edit (WPScanTeam): better payload (no interaction needed other than editing the affected Form): " style="animation-name:rotation" onanimationstart="alert(/XSS/)//
Affects Plugins
Fixed in version 1.13.60
References
Classification
Miscellaneous
Original Researcher
Felipe Restrepo Rodriguez
Submitter
Felipe Restrepo Rodriguez
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-07-15 (about 10 months ago)
Added
2021-07-15 (about 10 months ago)
Last Updated
2021-07-30 (about 9 months ago)