Wise Forms <= 1.2.0 – Unauthenticated Stored XSS | CVE 2024-13603 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks via malicious form submissions.

Proof of Concept

This requires an old version of WordPress, i.e. 4.8.25:

1. As an admin, add a form and insert it into a post/page via shortcode
2. As an unauthenticated user, open the page created in step 1
3. Fill out the form and in the message field enter the payload `"><script>alert("XSS")</script>`
4. Submit the form.
5. Log in as an administrator and navigate to the WP-Admin page.
6. Go to the Wise Forms "Results" section and view the submitted form data.
7. Observe that the XSS payload is rendered on the page, causing an alert to display the message "XSS".

Affects Plugins

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Steven Pereira aka Cursed, Anjali Kumari aka HexJello & Muktanand Kale aka Muktimantras

Submitter

Steven Pereira aka Cursed

Submitter website

https://cursedsec.com

Verified

Yes

WPVDB ID

234a8d22-e6c6-4819-9ac0-434a96b3462d

Timeline

Publicly Published

2025-01-27 (about 11 months ago)

Added

2025-01-27 (about 11 months ago)

Last Updated

2025-06-27 (about 6 months ago)

Other

Published

Title

Published

2022-05-31

Title

GTM4WP < 1.15.2 - Admin+ Stored Cross-Site Scripting

Published

2017-05-31

Title

WP No External Links <= 3.5.18 – Authenticated Cross-Site Scripting (XSS)

Published

2025-04-29

Title

Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS

Published

2025-01-16

Title

melascrivi-plugin <= 1.4 - Reflected Cross-Site Scripting

Published

2024-12-03

Title

Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library