Skip to content
Sign in
5.9 Medium

CVE-2024-6243 The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing…

Description

The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.

Affected products and versions

Product Affected versions Fixed in
HTML Forms 1.3 earliest → < 1.3.33 1.3.33
html_forms 1.3 earliest → < 1.3.33 1.3.33

Other CVEs of HTML Forms

The 3 CVEs of HTML Forms →
CVE-2024-6412 The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers… 6.5 Medium CVE-2022-3689 The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL… 7.2 High
Track this CVE