Lucene search
WPScanCVELIST:CVE-2024-3113HistoryJul 30, 2024 - 6:00 a.m.
CVE-2024-3113 FormFlow < 2.12.2 - Admin+ Stored XSS
2024-07-3006:00:06
WPScan
www.cve.org
2
cve-2024-3113
stored cross-site scripting
wordpress plugin
EPSS
0
Percentile
9.4%
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CNA Affected
[
{
"vendor": "Unknown",
"product": "FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "2.12.2"
}
],
"defaultStatus": "unaffected"
}
]Related
vulnrichment
vulnrichment
CVE-2024-3113 FormFlow < 2.12.2 - Admin+ Stored XSS
2024-07-30 06:00:06
cve
cve
CVE-2024-3113
2024-07-30 06:15:02
nvd
nvd
CVE-2024-3113
2024-07-30 06:15:02
wordfence
wordfence