CVE-2024-2542 Jotform Online Forms <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-2542

The CVE-2024-2542 issue affects the Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms WordPress plugin up to version 1.3.1, with stored XSS via shortcode attributes. Root cause is insufficient input sanitization and output escaping, enabling authenticated users with co...