CVE-2023-6830mediumCWE-79

CVE-2023-6830: fallo de gravedad media en strategy11team Formidable Forms – Contact Form…

Formidable Forms <= 6.7 - HTML Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
strategy11team · Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
CVEs relacionadas — strategy11team Formidable Forms – Contact Form…

En el mismo producto, de las más peligrosas a las menos.

CVE-2017-20194MEDIUMFormidable Form Builder < 2.05.03 - Unauthenticated Information DisclosureEPSS 1.1%CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-11188MEDIUMFormidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form ParameterEPSS 0.4%CVE-2026-2888MEDIUMFormidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' ParameterEPSS 0.4%CVE-2024-6725MEDIUMFormidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-2890HIGHFormidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent ReuseEPSS 0.4%