Forminator and Forminator Pro < 1.27.0 – Admin+ Stored Cross-Site Scripting | CVE 2023-5119 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Proof of Concept

Select the "Redirect user to a URL" in the after submission behaviour, and use the following URL:

javascript:alert(document.domain)

The payload will trigger whenever anybody submits the form.

Affects Plugins

Fixed in 1.27.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Mohamed Azarudheen

Submitter

Mohamed Azarudheen

Verified

Yes

WPVDB ID

229207bb-8f8d-4579-a8e2-54516474ccb4

Timeline

Publicly Published

2023-10-27 (about 2 years ago)

Added

2023-10-27 (about 2 years ago)

Last Updated

2023-10-27 (about 2 years ago)

Other

Published

Title

Published

2014-10-08

Title

Google Calendar Events < 2.0.4 - XSS

Published

2025-03-11

Title

In Stock Mailer for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting

Published

2025-01-16

Title

Flexible Blogtitle <= 0.1 - Reflected Cross-Site Scripting

Published

2024-10-31

Title

Gutenberg Blocks with AI by Kadence WP – Page Builder Features < 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget

Published

2023-04-17

Title

Japanized For WooCommerce < 2.5.8 - Reflected XSS