Formidable Forms < 6.7.1 - HTML Injection

2024-01-1000:00:00

wpscan.com

formidable forms

html injection

vulnerability

unauthenticated users

arbitrary code

entries view page

admin area defacement

malicious websites

security

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

20.5%

JSON

Description The plugin is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites.