CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
Form Vibes stores contact form submissions in the database but does not properly sanitize user input before displaying it in the admin interface. An attacker can inject malicious JavaScript into form fields, which executes when site administrators view submissions. The vulnerability affects all versions up to 1.5.2 and requires no authentication or user interaction from the attacker.
What an attacker can do
Inject JavaScript code that runs in administrators' browsers when they view form submissions.
Potential impact on your site
Admins viewing form entries may have their sessions hijacked or credentials stolen via malicious scripts.
Conditions required to exploit
Attacker can submit a form on the site; no authentication required.
Key dates
External resources
Related vulnerabilities
