CVE-2024-13605

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13605

creationtimestamp| type| source ---|---|--- 2025-02-24 06:22:04+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5129 2025-02-24 07:55:30+00:00| seen| https://t.me/cvedetector/18781 2025-02-24 08:37:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3livx2exbbc2t 2025-02-24...

CVE-2024-13605

The CVE-2024-13605 entry concerns Form Maker by 10Web for WordPress, affecting versions prior to 1.15.33. It is a Stored XSS in certain settings due to insufficient sanitisation/escaping, which can be triggered by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., ...

CVE-2024-13605 Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...