WordPress Plugin Vulnerabilities

Form Maker by 10Web < 1.15.19 - Unauthenticated Stored XSS

Description

The plugin does not validate and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
form-maker
Fixed in 1.15.19

References

CVE
CVE-2023-45071

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
FearZzZz
Verified
No
WPVDB ID
c3267af7-e292-4bab-a808-db72332b1520

Timeline

Publicly Published
2023-10-03 (about 2 years ago)
Added
2023-10-20 (about 2 years ago)
Last Updated
2023-10-20 (about 2 years ago)

Other

Published
Title
Published
2025-11-04
Title
Spectra < 2.19.15 - Contributor+ Stored XSS via Custom CSS
Published
2024-12-19
Title
Sell Tickets Online – TicketSource Ticket Shop for WordPress < 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-16
Title
all-in-one-box-login <= 2.0.1 - Reflected Cross-Site Scripting
Published
2024-04-27
Title
Survey Maker – Best WordPress Survey Plugin < 3.6.4 - Unauthenticated Stored Cross-Site Scripting
Published
2025-03-21
Title
Bitspecter Suite < 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload