CVE-2024-9528
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Oct 5, 2024
Updated: Feb 6, 2025
CWE ID 79
Summary
CVE-2024-9528 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Contact Form Plugin by Fluent Forms, used for creating Quiz, Survey, and Drag & Drop WP Forms in WordPress. Versions up to and including 5.1.19 are vulnerable to this issue. Attackers, with the required edit form access (which is default for administrators), can inject arbitrary web scripts into form label fields. These scripts are then stored and executed whenever a user visits an injected page, posing a significant security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Fluentforms Contact Form