CVE-2017-20192: Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'afterhtml' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20192?
CVE-2017-20192 is considered a critical vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2017-20192?
To fix CVE-2017-20192, update the Formidable Form Builder plugin to version 2.05.03 or later.
What versions of Formidable Form Builder are affected by CVE-2017-20192?
CVE-2017-20192 affects versions of Formidable Form Builder prior to 2.05.03.
What type of attack does CVE-2017-20192 enable?
CVE-2017-20192 allows untrusted users to perform Stored Cross-Site Scripting attacks.
Who is impacted by CVE-2017-20192?
Users of the Formidable Form Builder plugin for WordPress who have not updated to version 2.05.03 are impacted by CVE-2017-20192.