CVE-2021-24596 - youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting

Published Sep 20, 2021

4.8

MEDIUM

CVSS 3.1

EPSS 2.75%

Description

The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected products

Vendor n/a Product youForms for WordPress – Creating Forms for CopeCart Default
n/a
- Version
  1.0.5
  Status
  affected
  Constraints
  <=1.0.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

youForms for WordPress – Creating Forms for CopeCart

n/a

Version	Status	Constraints
1.0.5	affected	<=1.0.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-11508
Advisory
https://wpscan.com/vulnerability/b5def0e7-2b4a-43e0-8175-28b28aa2f8ae
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-11508		Advisory
https://wpscan.com/vulnerability/b5def0e7-2b4a-43e0-8175-28b28aa2f8ae		x_refsource_MISCExploitThird Party Advisory