PT-2019-8531 · WordPress · Formcraft3

Published 2019-09-10 · Updated 2019-09-10 · CVE-2017-18600

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions formcraft3 plugin versions prior to 3.4 for WordPress

Description The issue is related to stored XSS, which occurs via the "New Form > Heading > Heading Text" field. This allows for malicious input to be stored and executed, potentially leading to security breaches.

Recommendations For formcraft3 plugin versions prior to 3.4, update to version 3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "New Form > Heading > Heading Text" field until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-18600

Affected Products

Formcraft3

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-18600 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18600 · Vendor Advisory
• https://t.me/cibsecurity/6647 · Telegram Post
• https://wpvulndb.com/vulnerabilities/8877 · Note