Formgent Next Gen Ai Form Builder For Wordpress With Multi Step Quizzes Payments More
Monthly
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.