CVE-2024-9651

Summary

CVE-2024-9651 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Fluent Forms WordPress plugin before version 5.2.1. Despite the unfiltered_html capability being disallowed, particularly in multisite configurations, high privilege users, including admins, can exploit the flaw by injecting malicious scripts into certain plugin settings. This vulnerability could potentially lead to unintended execution of malicious code within a WordPress site.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.