WordPress Plugin Vulnerabilities

Formzu WP < 1.6.7 - Contributor+ Stored XSS via id

Description

The plugin does not validate and escape the ‘id’ parameter, allowing users with the contributor role and above perform Stored XSS attacks

Affects Plugins

Plugin icon
formzu-wp
Fixed in 1.6.7

References

CVE
CVE-2023-49160
URL
https://patchstack.com/database/vulnerability/formzu-wp/wordpress-formzu-wp-plugin-1-6-6-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
resecured.io
Verified
No
WPVDB ID
8985f9ac-c56b-4989-830b-f873722692a0

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-08 (about 2 years ago)
Last Updated
2023-12-13 (about 2 years ago)

Other

Published
Title
Published
2024-05-14
Title
Landing Page Builder < 1.5.1.9 - Reflected Cross-Site Scripting via pageType
Published
2025-01-07
Title
Alpha Price Table For Elementor <= 1.2.0 - Contributor+ Stored XSS
Published
2025-09-05
Title
金数据 <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-04-20
Title
My Calendar <= 2.3.28 - Cross-Site Scripting (XSS)
Published
2022-09-13
Title
Soledad < 8.2.5 - Reflected Cross-site Scripting