Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS

2023-10-3100:00:00

Carlos David Garrido León

gravity forms

xss

admin

plugin

translations

0.0004 Low

EPSS

Percentile

14.1%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

The "Translations" settings of the plugin are vulnerable to XSS using the payload: `"/><img src=x onerror=alert(/XSS/)>`
Entering it for any value and reloading the page will result in the XSS.

0.0004 Low

EPSS

Percentile

14.1%

JSON

Related for WPEX-ID:E5664DA4-5B78-4E42-BE6B-E0D7B73A85B0