Smart Forms – when you need more than just a contact form, CVE-2024-1905

CVE, Research URL: CVE-2024-1905
Home page URL: Security reports for Smart Forms – when you need more than just a contact form
Application: Smart Forms – when you need more than just a contact form
Published on: Apr 29, 2024
Research Description: The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions: max 2.6.96.
Status: vulnerable

Smart Forms &#8211; when you need more than just a contact form, CVE-2024-1905