CVE-2023-0169: Zoho Forms < 3.0.1 - Contributor+ Stored XSS
First published: Mon Feb 13 2023(Updated: )
The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Zoho Forms | <3.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for the Zoho Forms WordPress plugin vulnerability?
The vulnerability ID for the Zoho Forms WordPress plugin vulnerability is CVE-2023-0169.
What is the severity of CVE-2023-0169?
The severity of CVE-2023-0169 is medium with a severity value of 5.4.
What does the Zoho Forms WordPress plugin vulnerability allow?
The Zoho Forms WordPress plugin vulnerability allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
How does the Zoho Forms WordPress plugin vulnerability work?
The Zoho Forms WordPress plugin before version 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, enabling Stored Cross-Site Scripting attacks.
How can I fix the Zoho Forms WordPress plugin vulnerability?
To fix the Zoho Forms WordPress plugin vulnerability, update to version 3.0.1 or later of the plugin.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/zohocorp
- canonical/zohocorp zoho forms