Forminator < 1.15.4 – Admin+ Stored Cross-Site Scripting | CVE 2021-24700 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Proof of Concept

As an admin, create or edit a Forminator form, add an email field and put the following payload in the label value: "><script>alert(/XSS/)</script>

The payload will then trigger when another user visits that form's Behavior > Redirect URL tab within the wp-admin panel.

Affects Plugins

Fixed in 1.15.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Shivam Rai

Submitter

Shivam Rai

Submitter twitter

Verified

Yes

WPVDB ID

1d489b05-296e-4268-8082-9737608f9b41

Timeline

Publicly Published

2021-10-20 (about 4 years ago)

Added

2021-10-20 (about 4 years ago)

Last Updated

2022-04-14 (about 3 years ago)

Other

Published

Title

Published

2013-07-23

Title

Download Monitor < 3.3.6.2 - Multiple Reflected Cross-Site Scripting

Published

2024-04-16

Title

WP-Lister Lite for eBay < 3.6.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

Published

2025-03-25

Title

Advanced iFrame < 2025.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-05-31

Title

FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting

Published

2021-04-26

Title

Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS