CVE-2023-5048

MEDIUM

WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-5048 has a selected CVSS score of 6.4 (medium).

Description

The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Affected products and versions

1
ProductSourceVersion range

WDContactFormBuilder

Browse 10web / WDContactFormBuilder

Default status: unaffected

CVE ListThrough 1.0.72affected

References

3