CVE-2023-4950 Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

2023-10-1619:38:58

WPScan

www.cve.org

cve-2023-4950

funnelforms free

cross-site scripting

wordpress plugin

unauthenticated stored

0.001 Low

EPSS

Percentile

30.3%

JSON

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.4"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58

0.001 Low

EPSS

Percentile

30.3%

JSON

Related for CVELIST:CVE-2023-4950