FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field

2023-03-2000:00:00

Vaibhav Rajput

fluentforms

stored xss

contributor

custom html

form field

text tab

exploit

0.001 Low

EPSS

Percentile

21.6%

JSON

The plugin does not properly sanitize and escape the srcdoc attribute in iframes in it’s custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.

As a contributor, create a blank form and add custom html field with the following content in the "Text" tab of the field editor:

<p>Some description about this section</p><p><iframe srcdoc="&#x3C;script&#x3E;alert(document.cookie)&#x3C;/script&#x3E;"></iframe></p>

Do not decode the payload. And please ensure that payload is added when editor has Text tab selected. Save the form, it will trigger xss payload.

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for WPEX-ID:078F33CD-0F5C-46FE-B858-2107A09C6B69