Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting | CVE 2023-4950 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

Proof of Concept

1. Create a contact form
2. Embed the contact form shortcode on a post or page.
3. As an Unauthitncated user, inject the inputs for a malicious script such as 
`<script>alert("MalekAlthubiany")</script>` into the name field
4. Go to the "Leads" section as an admin
5. See the XSS

Affects Plugins

funnelforms-free

Fixed in 3.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Malek Althubiany

Submitter

Malek Althubiany

Submitter website

https://www.linkedin.com/in/malek-althubiany-b82b65197/

Submitter twitter

Verified

Yes

WPVDB ID

73db1ee8-06a2-41b6-b287-44e25f5f2e58

Timeline

Publicly Published

2023-09-12 (about 2 years ago)

Added

2023-09-20 (about 2 years ago)

Last Updated

2023-09-20 (about 2 years ago)

Other

Published

Title

Published

2024-12-06

Title

Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! < 1.5 - Reflected Cross-Site Scripting

Published

2024-09-30

Title

Automatically Hierarchic Categories in Menu < 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-05-03

Title

PropertyHive < 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-03-23

Title

Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting

Published

2021-09-21

Title

OptinMonster < 2.6.1 - Reflected Cross-Site Scripting (XSS)