CVE-2021-24514 Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed...

CVE-2021-24514

CVE-2021-24514 – Visual Form Builder (WordPress) Root cause: The Visual Form Builder plugin is affected by a stored XSS vulnerability due to insufficient sanitization/escaping of the Form Name. This allows high-privilege users (e.g., admin) to inject XSS payloads, even when unfiltered_html is dis...