CVE-2023-0546

FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field

Medium · published April 10, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00478 · 40.3th percentile
Published
2023-04-10T13:18Z
EPSS history
Timeline
  • 10 APR 13:18Z
    FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field
    cvelistv5