Lucene search

WordfenceCVE-2023-6830

HistoryJan 09, 2024 - 7:15 a.m.

CVE-2023-6830

2024-01-0907:15:13

CWE-79

Wordfence

web.nvd.nist.gov

formidable forms

wordpress

html injection

vulnerability

unauthenticated users

form fields

admin area defacement

nvd

cve-2023-6830

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

20.5%

JSON

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites.

Affected configurations

Nvd

Vulners

Node

strategy11formidable_form_builderRange≤6.7wordpress

VendorProductVersionCPE
strategy11formidable_form_builder*cpe:2.3:a:strategy11:formidable_form_builder:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
strategy11	formidable_form_builder	*	cpe:2.3:a:strategy11:formidable_form_builder::::::wordpress::*

CNA Affected

[
  {
    "vendor": "sswells",
    "product": "Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "6.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6?source=cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

20.5%

JSON

Related for CVE-2023-6830