CVE-2021-24526 Form Maker < 1.13.60 - Authenticated Stored XSS

2021-08-1610:48:26

CWE-79

WPScan

www.cve.org

form maker wordpress plugin

authenticated

stored xss

EPSS

0.001

Percentile

24.8%

JSON

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue

CNA Affected

[
  {
    "product": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.13.60",
        "status": "affected",
        "version": "1.13.60",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/17287d8a-ba27-42dc-9370-a931ef404995

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24526