CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
Explanation of Vulnerability in Simple Terms
Contact Form by Bit Form versions 2.0 through 2.13.9 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into form fields that execute in the browsers of other users viewing the form. The vulnerability requires high-level privileges to exploit and does not require user interaction from the victim.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view the form.
Potential impact on your site
Administrators can be compromised; malicious scripts could steal session tokens, modify site content, or redirect users.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
