Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

2023-09-2000:00:00

Malek Althubiany

funnelforms free 3.4

unauthenticated stored cross-site scripting

contact form

shortcode

injection

leads section

admin

xss exploit

0.001 Low

EPSS

Percentile

30.3%

JSON

Description The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

1. Create a contact form
2. Embed the contact form shortcode on a post or page.
3. As an Unauthitncated user, inject the inputs for a malicious script such as 
`<script>alert("MalekAlthubiany")</script>` into the name field
4. Go to the "Leads" section as an admin
5. See the XSS

0.001 Low

EPSS

Percentile

30.3%

JSON

Related for WPEX-ID:73DB1EE8-06A2-41B6-B287-44E25F5F2E58