CVE-2020-10385

CVE-2020-10385 describes a stored cross-site scripting (XSS) vulnerability in the WordPress plugin WPForms Lite (wpforms-lite) before version 1.5.9. The root cause is insufficient validation/sanitization of user input in the Form Description and Field Description fields, enabling injected scripts...

CVE-2024-11273

The Contact Form & SMTP Plugin for WordPress by PirateForms (versions prior to 2.6.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitize and escape certain settings, which allows high-privilege users, such as administrators, to execute scripts. ...