CVE-2023-6842

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 66.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Strategy11 Formidable Form Builder
Timeline
PublishedJan 9
Latest updateApr 11

Description

The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:NExploitability: 1.3 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

3
VulDB
Formidable Forms Plugin up to 6.7 on WordPress cross site scripting↗2026-04-11
▶
GHSA
GHSA-hrg2-9cxg-f9w6: The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-S↗2024-01-09
▶
CVEList
Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting↗2024-01-09
▶