WordPress Contact Form - Reflected cross-site scripting (XSS)
Summary
Full name
WordPress Contact Form, Drag and Drop Form Builder Plugin - Live Forms - Reflected cross-site scripting (XSS)
Code name
State
Private
Release date
3 de jan. de 2025
Affected product
WordPress Contact Form, Drag and Drop Form Builder Plugin - Live Forms
Affected version(s)
Version
Vulnerability name
Reflected cross-site scripting (XSS)
Vulnerability type
Remotely exploitable
No
CVSS v4.0 vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
Exploit available
No
CVE ID(s)
Description
WordPress Contact Form, Drag and Drop Form Builder Plugin - Live Forms was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/views/showreqs.php.
Vulnerability
Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in WordPress Contact Form, Drag and Drop Form Builder Plugin - Live Forms . The following is the output of the tool:
Skims output
Our security policy
We have reserved the ID CVE-2025-0776 to refer to this issue from now on.
System Information
Version: WordPress Contact Form, Drag and Drop Form Builder Plugin - Live Forms
Mitigation
There is currently no patch available for this vulnerability.
Timeline
Vulnerability discovered
3 de jan. de 2025
Vendor contacted
3 de jan. de 2025
