PT-2021-16111 · WordPress · Youforms

[e-mail] Inc · Published 2021-09-20 · Updated 2021-10-01 · CVE-2021-24596

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions youForms for WordPress plugin versions 1.0.0 through 1.0.5

Description The issue allows high privilege users, such as editors and admins, to perform Cross-Site Scripting attacks. This is possible because the Button Text field of the plugin's Templates does not properly sanitise or escape input, even when the unfiltered html capability is disallowed.

Recommendations For youForms for WordPress plugin versions 1.0.0 through 1.0.5, update to a version later than 1.0.5 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24596

Affected Products

Youforms

References · 3

• 🔥 https://wpscan.com/vulnerability/b5def0e7-2b4a-43e0-8175-28b28aa2f8ae · Exploit
• https://osv.dev/vulnerability/CVE-2021-24596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24596 · Security Note