NEX-Forms – Ultimate Form Builder – Contact forms and much more, CVE-2021-24705
- CVE, Research URL
- Home page URL
-
Security reports for NEX-Forms – Ultimate Form Builder – Contact forms and much more
- Published on
- Dec 13, 2021
- Research Description
- The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Affected versions
-
Min -, max 8.4.3.
- Status
-
vulnerable