CVE-2023-0439

Description

The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.

Reserved 2023-01-23 | Published 2023-07-17 | Updated 2024-10-30 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 8.4.4
affected

Credits

Felipe Restrepo Rodriguez and Edison Poveda finder

WPScan coordinator

References

wpscan.com/...erability/04cea9aa-b21c-49f8-836b-2d312253e09a exploit vdb-entry technical-description

cve.org (CVE-2023-0439)

nvd.nist.gov (CVE-2023-0439)

Download JSON