CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS.This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1.
Explanation of Vulnerability in Simple Terms
The Zoho Forms WordPress plugin through version 3.0.1 contains a stored cross-site scripting (XSS) vulnerability. An attacker with low-level access can inject malicious scripts into form data that execute in other users' browsers when they view the form. The vulnerability requires user interaction and can affect site visitors across the application.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they interact with forms.
Potential impact on your site
Site visitors and admins can have their sessions hijacked, credentials stolen, or be redirected to malicious sites via form interactions.
Conditions required to exploit
Attacker needs a low-privilege account (e.g., subscriber or contributor) and the victim must view the affected form.
Key dates
External resources
Related vulnerabilities
