PT-2024-38513 · WordPress · Flaming Forms

Bob Matyas · Published 2024-09-01 · Updated 2024-10-04 · CVE-2024-7691

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flaming Forms WordPress plugin versions 1.0.1 and earlier

Description The issue is related to the Flaming Forms WordPress plugin, which does not properly sanitise and escape certain parameters. This could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.

Recommendations For versions 1.0.1 and earlier, update to a version that properly sanitises and escapes parameters to prevent Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the plugin's functionality to minimise the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7691

Affected Products

Flaming Forms

References · 9

• 🔥 https://wpscan.com/vulnerability/d30a3b95-5d1f-4755-8b61-19946afc51ef · Exploit
• https://osv.dev/vulnerability/CVE-2024-7691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7691 · Security Note
• https://t.me/cvenotify/93075 · Telegram Post
• https://t.me/cvenotify/92986 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1830554340639064526 · Twitter Post
• https://t.me/cvedetector/4610 · Telegram Post
• https://t.me/cvenotify/97063 · Telegram Post
• https://twitter.com/CVEnew/status/1830491387391062185 · Twitter Post