The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Thu, 06 Feb 2025 19:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Fluentforms
Fluentforms contact Form |
|
Weaknesses | CWE-79 | |
CPEs | cpe:2.3:a:fluentforms:contact_form:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Fluentforms
Fluentforms contact Form |

Status: PUBLISHED
Assigner: Wordfence
Published: 2024-05-18T07:38:34.748Z
Updated: 2024-08-01T20:47:41.645Z
Reserved: 2024-05-09T21:47:25.247Z
Link: CVE-2024-4709

Updated: 2024-08-01T20:47:41.645Z

Status : Analyzed
Published: 2024-05-18T08:15:08.410
Modified: 2025-02-06T18:37:12.683
Link: CVE-2024-4709

No data.