Medium severity · published Oct 25, 2021
CVE-2021-24608
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Formidable Form Builder · Strategy11
before 5.0.07 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24608
Patch
https://plugins.trac.wordpress.org/changeset/2609911
Exploit
https://wpscan.com/vulnerability/75305ea8-730b-4caf-a3c6-cb94adee683c
More from Formidable Form Builder
9.8
CVE-2019-15780
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization
9.6
CVE-2021-24884
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated,…
8.8
CVE-2023-24419
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions
6.5
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of…
6.1
CVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting