CVE-2024-1905: Smart Forms < 2.6.96 - Admin+ Stored XSS
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1905?
The severity of CVE-2024-1905 is considered high due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-1905?
To fix CVE-2024-1905, update the Smart Forms WordPress plugin to version 2.6.96 or later.
Who is affected by CVE-2024-1905?
CVE-2024-1905 affects users of the Smart Forms WordPress plugin versions prior to 2.6.96.
What types of attacks can CVE-2024-1905 enable?
CVE-2024-1905 can enable Stored Cross-Site Scripting attacks which may compromise site security and data.
What settings are not properly sanitized in CVE-2024-1905?
CVE-2024-1905 involves certain settings in the Smart Forms plugin that are not sanitized or escaped.