CVE-2024-2258: Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2258?
CVE-2024-2258 is considered a moderate severity vulnerability due to the risk of stored cross-site scripting.
How do I fix CVE-2024-2258?
To fix CVE-2024-2258, update the 10Web Form Maker plugin to the latest version beyond 1.15.24.
What versions are affected by CVE-2024-2258?
CVE-2024-2258 affects all versions of the 10Web Form Maker plugin up to and including 1.15.24.
What kind of attacks can CVE-2024-2258 enable?
CVE-2024-2258 can enable attackers to perform stored cross-site scripting attacks through user input that is not properly sanitized.
Is user data at risk due to CVE-2024-2258?
Yes, CVE-2024-2258 puts user data at risk by allowing malicious scripts to be executed in the context of a victim's browser.