CVE-2021-25107: Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-25107?
CVE-2021-25107 is a vulnerability in the Form Store to DB WordPress plugin that allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks against the admin.
What is the severity of CVE-2021-25107?
The severity of CVE-2021-25107 is medium with a CVSS score of 6.1.
How can an attacker exploit CVE-2021-25107?
An attacker can exploit CVE-2021-25107 by inputting malicious script code as parameter keys in the created entry, which will be outputted without proper sanitization and escaping, resulting in a Cross-Site Scripting attack.
Is authentication required to exploit CVE-2021-25107?
No, authentication is not required to exploit CVE-2021-25107 as it allows unauthenticated attackers to perform Cross-Site Scripting attacks.
How can CVE-2021-25107 be mitigated?
To mitigate CVE-2021-25107, users of the Form Store to DB WordPress plugin should update to version 1.1.1 or later, which includes proper sanitization and escaping of parameter keys.