CVE-2024-7052: Forminator < 1.38.3 - Admin+ Stored XSS
Published Feb 14, 2025
·Updated
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
2 affected components
WP Forminator Forminator Forms<1.38.3
wpmudev Forminator Forms Wordpress<1.38.3
Event History
Feb 14, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-7052?
CVE-2024-7052 has been classified as a moderate severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
2
How do I fix CVE-2024-7052?
To fix CVE-2024-7052, update the Forminator Forms plugin to version 1.38.3 or later.
3
Who is affected by CVE-2024-7052?
CVE-2024-7052 affects WordPress sites using Forminator Forms plugin versions prior to 1.38.3.
4
What type of vulnerability is CVE-2024-7052?
CVE-2024-7052 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
Can unprivileged users exploit CVE-2024-7052?
No, CVE-2024-7052 requires high privilege users, such as Admins, for exploitation.