CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite zigaform-calculator-cost-estimation-form-builder-lite allows Stored XSS.This issue affects Zigaform – Price Calculator & Cost Estimation Form Builder Lite: from n/a through <= 7.4.2.
Explanation of Vulnerability in Simple Terms
Zigaform Price Calculator & Cost Estimation Form Builder Lite versions 7.4.2 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into form fields that execute in users' browsers when they view the form. The vulnerability requires user interaction and can affect other users or administrators viewing the compromised form.
What an attacker can do
Inject malicious scripts that run in users' browsers when they view or interact with the form.
Potential impact on your site
Attackers can steal user data, session tokens, or credentials from anyone viewing forms built with this plugin.
Conditions required to exploit
No authentication required. A victim must visit a page containing the affected form or click a link to it.
Key dates
External resources
Related vulnerabilities
