Skip to main content

Funnelforms CVE-2023-4950

MEDIUM
2023-10-16 contact@wpscan.com
WordPress XSS Funnelforms
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 16, 2023 - 20:15 nvd
MEDIUM 6.1

DescriptionNVD

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

AnalysisAI

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks Affected products include: Funnelforms. Version information: before 3.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Funnelforms

View all
CVE-2024-6312 MEDIUM
6.5 Aug 28

The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including,
CVE-2023-5990 MEDIUM POC
6.5 Dec 04

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not

CVE-2024-6311 HIGH
7.2 Aug 28

The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
CVE-2023-5386 MEDIUM
6.5 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability
CVE-2023-5382 MEDIUM
6.5 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,

CVE-2024-5857 MEDIUM
5.3 Aug 29

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor - Funnelforms Free plugin for WordPress
CVE-2024-7447 MEDIUM
5.3 Aug 28

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor - Funnelforms Free plugin for WordPress
CVE-2023-5419 MEDIUM
4.3 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability
CVE-2023-5383 MEDIUM
4.3 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,

CVE-2023-5417 MEDIUM
4.3 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability
CVE-2023-5416 MEDIUM
4.3 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability
CVE-2023-5415 MEDIUM
4.3 Nov 22

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2023-4950 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy