Repeater Fields For Elementor Forms
Monthly
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; version 2.2.8 resolves the issue.
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; version 2.2.8 resolves the issue.