CVE-2022-0830 FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF

2022-04-0415:35:50

CWE-352

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

26.4%

JSON

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.

CNA Affected

[
  {
    "product": "FormBuilder",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.08",
        "status": "affected",
        "version": "1.08",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/114c0202-39f8-4748-ac0d-013d2d6f02f7

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for CVELIST:CVE-2022-0830