CVE-2023-0084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0084
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail= Patch
https://wordpress.org/plugins/metform/#description Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail= Patch
https://wordpress.org/plugins/metform/#description Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 07:36

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail= - Patch () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail= - Patch
References () https://wordpress.org/plugins/metform/#description - Product () https://wordpress.org/plugins/metform/#description - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 - Third Party Advisory
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 7.2

07 Nov 2023, 03:59

Type Values Removed Values Added
CWE CWE-79
Information

Published : 2023-03-02 19:15

Updated : 2024-11-21 07:36

NVD link : CVE-2023-0084

Mitre link : CVE-2023-0084

CVE.ORG link : CVE-2023-0084

JSON object : View

Products Affected

wpmet

  • metform_elementor_contact_form_builder
CWE

No CWE.