Smart Forms When You Need More Than Just A Contact Form
Monthly
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.