CVE-2021-24608: Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed
Other sources
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24608?
CVE-2021-24608 is rated as a medium severity vulnerability due to the potential for exploit through Cross-Site Scripting attacks.
How do I fix CVE-2021-24608?
To fix CVE-2021-24608, update the Formidable Form Builder plugin to version 5.0.07 or later.
What does CVE-2021-24608 exploit?
CVE-2021-24608 exploits improper sanitization and escaping of form labels used in the Formidable Form Builder plugin.
Who is affected by CVE-2021-24608?
Users of the Formidable Form Builder plugin for WordPress who have versions prior to 5.0.07 are affected by CVE-2021-24608.
What types of attacks can CVE-2021-24608 enable?
CVE-2021-24608 can enable high privileged users to perform Cross-Site Scripting attacks.