WordPress Plugin Vulnerabilities

Optin Forms < 1.3.3 - Admin+ Stored XSS

Description

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affects Plugins

Plugin icon
optin-forms
Fixed in 1.3.3

References

CVE
CVE-2023-29434

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Rio Darmawan
Verified
No
WPVDB ID
4ca30c79-020f-4587-9f0a-5191a1bd48a4

Timeline

Publicly Published
2023-06-26 (about 10 months ago)
Added
2023-06-27 (about 10 months ago)
Last Updated
2023-08-18 (about 8 months ago)

Other

Published
Title
Published
2023-12-07
Title
Alma < 5.2.1 - Contributor+ Stored XSS
Published
2018-08-19
Title
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
Published
2023-05-12
Title
Sunny Search <= 1.0.2 - Admin+ Stored XSS
Published
2023-01-18
Title
TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS
Published
2014-08-01
Title
Crius - VideoJS Cross-Site Scripting