The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-09T05:33:27.746Z
Updated: 2023-06-09T05:33:27.746Z
Reserved: 2023-02-07T15:07:37.124Z
Link: CVE-2023-0708
JSON object: View
NVD Information
Status : Modified
Published: 2023-06-09T06:15:52.557
Modified: 2023-11-07T04:01:16.740
Link: CVE-2023-0708
JSON object: View
Redhat Information
No data.
CWE
No CWE.