CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
Explanation of Vulnerability in Simple Terms
The Tripetto WordPress form builder plugin versions 8.0.9 and earlier contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts. The vulnerability affects the plugin's handling of user input across site boundaries. Attackers can exploit this to steal session tokens, deface forms, or redirect users to malicious sites.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and affects other users or site functionality.
Potential impact on your site
Visitors to your site may have their sessions hijacked, see defaced forms, or be redirected to phishing pages.
Conditions required to exploit
No authentication or user interaction required; attacker can exploit this remotely by crafting a malicious request.
Key dates
External resources
