The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-09T05:33:13.737Z
Updated: 2023-06-09T05:33:13.737Z
Reserved: 2023-02-07T15:10:10.640Z
Link: CVE-2023-0709
JSON object: View
NVD Information
Status : Modified
Published: 2023-06-09T06:15:52.820
Modified: 2023-11-07T04:01:16.963
Link: CVE-2023-0709
JSON object: View
Redhat Information
No data.
CWE
No CWE.