CVE-2021-25107CWE-79

Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

published February 14, 2022

CVSS
—
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01523 · 74.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-14T09:20Z
EPSS history
Timeline
  • 14 FEB 09:20Z
    Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
    cvelistv5