CVE-2023-4950

Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

CVSS 6.1 MEDIUMEPSS 0.5%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 out 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

Unknown · Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor

Referências

https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58