The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Mon, 28 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Manidoraisamy
Manidoraisamy formfacade
CPEs cpe:2.3:a:manidoraisamy:formfacade:*:*:*:*:*:*:*:*
Vendors & Products Manidoraisamy
Manidoraisamy formfacade
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Sat, 26 Oct 2024 02:45:00 +0000

Type Values Removed Values Added
Description The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title FormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-10-26T02:31:32.274Z

Updated: 2024-10-28T17:37:23.501Z

Reserved: 2024-10-07T22:24:46.859Z

Link: CVE-2024-9613

cve-icon Vulnrichment

Updated: 2024-10-28T17:37:16.184Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-10-26T03:15:03.927

Modified: 2024-10-28T13:58:09.230

Link: CVE-2024-9613

cve-icon Redhat

No data.