CRM Perks Forms < 1.1.2 - Admin+ Stored Cross-Site Scripting

2023-05-3000:00:00

wpvulndb

crm perks forms

vulnerability

stored cross-site scripting

admin

exploit

EPSS

0.001

Percentile

36.4%

JSON

The plugin does not sanitize and escape the form_id field in the plugin settings page, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

https://example.com/wp-admin/admin.php?page=cfx-form&form_id=66%3F"onmouseover=alert(1)//

References

github.com/Don-H50/wp-vul/blob/main/CPF-xss-exploit.md

EPSS

0.001

Percentile

36.4%

JSON

Related for WPEX-ID:FCC8DA17-BC08-4543-A3B5-126BAB113D36