CVE-2024-3113: FormFlow < 2.12.2 - Admin+ Stored XSS
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3113?
CVE-2024-3113 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-3113?
To fix CVE-2024-3113, update the FormFlow: WhatsApp Social and Advanced Form Builder plugin to version 2.12.2 or later.
Who is affected by CVE-2024-3113?
CVE-2024-3113 affects users of the FormFlow: WhatsApp Social and Advanced Form Builder plugin versions prior to 2.12.2.
What type of vulnerability is CVE-2024-3113?
CVE-2024-3113 is a Stored Cross-Site Scripting (XSS) vulnerability.
Can non-admin users exploit CVE-2024-3113?
No, CVE-2024-3113 can only be exploited by high privilege users such as admin.