CVE-2024-9768 | THREATINT

Assigner	WPScan
Reserved	2024-10-09
Published	2024-11-21
Updated	2024-11-21

Description

The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Product status

Default status

unaffected

Any version before 6.14.1

affected

Credits

Krugov Artyom finder

WPScan coordinator

References

https://wpscan.com/vulnerability/3c4ff11b-4a06-433d-8f0e-4069865721c0/ exploit vdb-entry technical-description

cve.org CVE-2024-9768

nvd.nist.gov CVE-2024-9768

Download JSON

https://cve.threatint.com/CVE/CVE-2024-9768

Support options

Helpdesk Telegram

Subscribe to our newsletter to learn more about our work.