Inquiry Form To Posts Or Pages
Monthly
Cross-site request forgery leading to stored cross-site scripting in Inquiry Form to Posts or Pages plugin version 1.0 for WordPress allows unauthenticated attackers to inject arbitrary scripts into administrator settings. The vulnerability stems from missing nonce validation on the settings update handler combined with insufficient input sanitization and output escaping, enabling an attacker to craft a malicious request that, when visited by a logged-in administrator, stores persistent XSS payloads. With a CVSS score of 4.3 and no evidence of public exploitation, this represents a moderate-severity threat requiring administrator interaction.
Stored cross-site scripting in the Inquiry Form to Posts or Pages WordPress plugin up to version 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'Form Header' field, executing when users access the plugin settings page or view pages containing the [inquiry_form] shortcode. The vulnerability stems from insufficient input sanitization during option storage and missing output escaping in two rendering locations. CVSS 4.4 reflects the high privilege requirement (administrator-only access) and limited impact, though the stored nature and cross-site scope elevate concern for sites with multiple administrators or role delegation.
Cross-site request forgery leading to stored cross-site scripting in Inquiry Form to Posts or Pages plugin version 1.0 for WordPress allows unauthenticated attackers to inject arbitrary scripts into administrator settings. The vulnerability stems from missing nonce validation on the settings update handler combined with insufficient input sanitization and output escaping, enabling an attacker to craft a malicious request that, when visited by a logged-in administrator, stores persistent XSS payloads. With a CVSS score of 4.3 and no evidence of public exploitation, this represents a moderate-severity threat requiring administrator interaction.
Stored cross-site scripting in the Inquiry Form to Posts or Pages WordPress plugin up to version 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'Form Header' field, executing when users access the plugin settings page or view pages containing the [inquiry_form] shortcode. The vulnerability stems from insufficient input sanitization during option storage and missing output escaping in two rendering locations. CVSS 4.4 reflects the high privilege requirement (administrator-only access) and limited impact, though the stored nature and cross-site scope elevate concern for sites with multiple administrators or role delegation.