CVE-2024-11223
CVSS 3.1 Score 4.7 of 10 (medium)
Details
Published Dec 26, 2024
Updated: Dec 30, 2024
Summary
CVE-2024-11223 is a stored cross-site scripting (XSS) vulnerability affecting the WPForms plugin for WordPress. Before version 1.9.2.3, the plugin failed to sanitize and escape certain settings, leaving them vulnerable to XSS attacks. Unprivileed users could exploit this flaw, but high privilege users, such as administrators, posed a greater risk. In multisite setups, even with the unfiltered_html capability disallowed, attacks could still be executed due to this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Wpforms Plugin
Affected Vendors
- WPForms