CRM Perks Forms < 1.1.2 - Admin+ Stored Cross-Site Scripting

2023-05-3000:00:00

wpscan.com

crm perks forms

stored cross-site scripting

unsanitized form_id

admin

arbitrary web scripts

multisite setup

0.001 Low

EPSS

Percentile

36.6%

JSON

The plugin does not sanitize and escape the form_id field in the plugin settings page, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

PoC

https://example.com/wp-admin/admin.php?page=cfx-form&form;_id=66%3F"onmouseover=alert(1)//

CPENameOperatorVersion
crm-perks-formslt1.1.2

CPE	Name	Operator	Version
	crm-perks-forms	lt	1.1.2

References

github.com/Don-H50/wp-vul/blob/main/CPF-xss-exploit.md

0.001 Low

EPSS

Percentile

36.6%

JSON

Related for WPVDB-ID:FCC8DA17-BC08-4543-A3B5-126BAB113D36