WordPress Plugin Vulnerabilities

Formidable Forms < 6.7.1 - HTML Injection

Description

The plugin is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites.

Affects Plugins

Plugin icon
formidable
Fixed in 6.7.1

References

CVE
CVE-2023-6830
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
drop
Verified
No
WPVDB ID
588c6292-34b0-48ad-9971-865ed0d87174

Timeline

Publicly Published
2024-01-08 (about 2 years ago)
Added
2024-01-10 (about 2 years ago)
Last Updated
2024-01-10 (about 2 years ago)

Other

Published
Title
Published
2025-12-04
Title
Jabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFO
Published
2025-12-05
Title
List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode
Published
2026-02-17
Title
Membership Plugin – Restrict Content < 3.2.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
Published
2024-07-05
Title
Premium Blocks – Gutenberg Blocks for WordPress < 2.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-03-20
Title
Contact List < 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter