CVE-2021-24884: Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting
First published: Mon Oct 25 2021(Updated: )
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Formidable Forms | <4.09.05 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-24884?
CVE-2021-24884 is considered a high-severity vulnerability due to the potential for HTML injection attacks.
How do I fix CVE-2021-24884?
To fix CVE-2021-24884, update the Formidable Forms plugin to version 4.09.05 or later.
Who is affected by CVE-2021-24884?
Users of the Formidable Forms WordPress plugin prior to version 4.09.05 are affected by CVE-2021-24884.
What types of attacks can CVE-2021-24884 enable?
CVE-2021-24884 can enable unauthenticated remote attackers to perform HTML injection attacks, potentially tricking users.
Is CVE-2021-24884 easy to exploit?
Yes, CVE-2021-24884 is considered relatively easy to exploit, making it a significant concern for affected users.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/title
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/strategy11
- canonical/formidable forms