CVE-2024-2258: XSS
First published: Sat Apr 27 2024(Updated: )
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 10Web Form Maker | <=1.15.24 | |
| <1.15.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2258?
CVE-2024-2258 is considered a moderate severity vulnerability due to the risk of stored cross-site scripting.
How do I fix CVE-2024-2258?
To fix CVE-2024-2258, update the 10Web Form Maker plugin to the latest version beyond 1.15.24.
What versions are affected by CVE-2024-2258?
CVE-2024-2258 affects all versions of the 10Web Form Maker plugin up to and including 1.15.24.
What kind of attacks can CVE-2024-2258 enable?
CVE-2024-2258 can enable attackers to perform stored cross-site scripting attacks through user input that is not properly sanitized.
Is user data at risk due to CVE-2024-2258?
Yes, CVE-2024-2258 puts user data at risk by allowing malicious scripts to be executed in the context of a victim's browser.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/first-publish-date
- agent/type
- agent/weakness
- agent/description
- agent/author
- agent/event
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/10web
- canonical/10web form maker