CVE-2021-24705 — Cross-site Scripting in Nex-forms

CWE-79 — Cross-site ScriptingCWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.8MEDIUMNVD
EPSS
0.1%
top 73.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Basixonline Nex-forms
Timeline
PublishedDec 13
Latest updateDec 14

Description

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-5w27-mg8j-wjm2: The NEX-Forms WordPress plugin through 7↗2021-12-14
▶
CVEList
NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF↗2021-12-13
▶