The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Fri, 08 Nov 2024 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Westguardsolutions
Westguardsolutions ws Form
CPEs cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:*
Vendors & Products Westguardsolutions
Westguardsolutions ws Form

Wed, 06 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 06 Nov 2024 02:15:00 +0000

Type Values Removed Values Added
Description The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-11-06T02:01:56.620Z

Updated: 2024-11-06T11:29:19.983Z

Reserved: 2024-10-31T20:18:31.418Z

Link: CVE-2024-10647

cve-icon Vulnrichment

Updated: 2024-11-06T11:29:05.741Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-06T02:15:15.930

Modified: 2024-11-08T21:20:50.847

Link: CVE-2024-10647

cve-icon Redhat

No data.