CVE-2023-25981 MEDIUM

CVE-2023-25981: WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

Vendor Themekraft

Product Post Form

Weakness CWE-79 · XSS

Published August 25, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Post Form versions up to 2.8.1 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into form fields. When other users view the affected content, the scripts execute in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on their behalf. The vulnerability requires user interaction to trigger.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that execute when other users view the form, stealing their session data or performing actions as them.

Potential impact on your site

04Site Impact

Authenticated users can inject persistent malicious code affecting all site visitors who view the compromised form.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account and trick a victim into viewing a page containing the injected payload.

Key dates

06Disclosure timeline

August 25, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-25981 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities