WordPress Plugin Vulnerabilities

Contact Form by WPForms < 1.8.1.3 - Reflected XSS

Description

The plugin does not sanitise and escape some parameters before outputting them back in the debug page when the WPFORMS_DEBUG constant is defined, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
wpforms-lite
Fixed in 1.8.1.3

References

CVE
CVE-2023-30500

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
9a7e7557-0fdb-46d7-97c1-ace6f3e18b9e

Timeline

Publicly Published
2023-06-20 (about 2 years ago)
Added
2023-06-22 (about 2 years ago)
Last Updated
2023-06-22 (about 2 years ago)

Other

Published
Title
Published
2024-05-31
Title
Google CSE <= 1.0.7 - Admin+ Stored XSS
Published
2021-05-31
Title
FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
Published
2025-07-23
Title
FunnelCockpit < 1.4.4 - Reflected Cross-Site Scripting via `error` Parameter
Published
2021-12-14
Title
H5P CSS Editor <= 1.0 - Reflected Cross-Site Scripting
Published
2025-04-16
Title
PropertyHive < 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting