CVE-2023-0710

2023-06-0905:33:23

Wordfence

www.cve.org

metform elementor

wordpress

cross-site scripting

authenticated attackers

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.6%

JSON

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the ‘fname’ attribute of the ‘mf_thankyou’ shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.

CNA Affected

[
  {
    "vendor": "xpeedstudio",
    "product": "Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]