The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
History

Sat, 21 Dec 2024 00:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2023-06-09T05:33:12.472Z

Updated: 2024-12-20T23:47:04.352Z

Reserved: 2023-02-06T21:25:18.777Z

Link: CVE-2023-0695

cve-icon Vulnrichment

Updated: 2024-08-02T05:17:50.389Z

cve-icon NVD

Status : Modified

Published: 2023-06-09T06:15:52.043

Modified: 2024-11-21T07:37:38.713

Link: CVE-2023-0695

cve-icon Redhat

No data.