CVE-2024-10471
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2024-10471 is a vulnerability affecting the Everest Forms WordPress plugin before version 3.0.4.2. This issue allows high privilege users, including administrators, to execute Stored Cross-Site Scripting (XSS) attacks. Despite the unfiltered_html capability being disallowed, especially in multisite setups, the plugin fails to sanitize and escape certain settings, making these attacks possible. This could potentially lead to unauthorized access, data theft, or other malicious activities. Users are strongly advised to update to the latest plugin version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.