CVE-2024-45625 — Cross-site Scripting in Forminator

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 51.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Incsub ForminatorWpmu DEV Forminator
Timeline
PublishedSep 9

Description

Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDincsub/forminator< 1.34.1
▶CVEListV5wpmu_dev/forminatorprior to 1.34.1

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
CVE-2024-45625: Cross-site scripting vulnerability exists in Forminator versions prior to 1↗2024-09-09
▶
GHSA
GHSA-7mq7-p8xv-m9wf: Cross-site scripting vulnerability exists in Forminator versions prior to 1↗2024-09-09
▶
CVE-2024-45625 — Cross-site Scripting in Forminator | cvebase