CVE-2024-9528: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting
First published: Sat Oct 05 2024(Updated: )
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fluent Forms | <5.1.20 | |
| Fluent Forms Contact Form Plugin | <=5.1.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed4dfee-5f14-47ce-abed-cd226c110665?source=cve
- https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/app/Services/FormBuilder/Components/BaseComponent.php#L191
- https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/boot/globals.php#L342
- https://plugins.trac.wordpress.org/changeset/3125227/
Frequently Asked Questions
What is the severity of CVE-2024-9528?
CVE-2024-9528 is considered a high-severity vulnerability due to its potential for stored cross-site scripting (XSS).
How do I fix CVE-2024-9528?
To mitigate CVE-2024-9528, update the Fluent Forms Contact Form Plugin to version 5.1.20 or later, which includes the necessary security fixes.
Which versions are affected by CVE-2024-9528?
CVE-2024-9528 affects all versions of the Fluent Forms Contact Form Plugin up to and including 5.1.19.
What type of vulnerability is CVE-2024-9528?
CVE-2024-9528 is a stored cross-site scripting (XSS) vulnerability that can be exploited through insufficient input sanitization.
What can attackers do with CVE-2024-9528?
Attackers exploiting CVE-2024-9528 can execute arbitrary JavaScript in the context of the user’s browser, potentially leading to data theft or session hijacking.
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/title
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/fluentforms
- canonical/fluent forms
- vendor/fluent forms
- canonical/fluent forms contact form plugin