Flaming Forms <= 1.0.1 – Unauthenticated Stored XSS | CVE 2024-7691 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.

Proof of Concept

1. As an admin, add a contact form
2. As an unauthenticated user, enter the payload `"><script>alert(1)</script>` for any of the contact form fields and submit
3. As an admin, view the form submissions and see the XSS

Affects Plugins

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

d30a3b95-5d1f-4755-8b61-19946afc51ef

Timeline

Publicly Published

2024-08-12 (about 1 year ago)

Added

2024-08-13 (about 1 year ago)

Last Updated

2024-08-13 (about 1 year ago)

Other

Published

Title

Published

2024-03-29

Title

Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget

Published

2022-07-07

Title

Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting

Published

2024-10-24

Title

WordPress Meta Data and Taxonomies Filter (MDTF) < 1.3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-08-11

Title

Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-07-19

Title

WP eStore < 8.5.6 - Settings Reset via CSRF