Vulnerability · Published Nov 18, 2024 · Assigned by Patchstack
CVE-2024-52347WordPress Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera plugin <= 4.0 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
In plain English
A medium-severity cross-site scripting in Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera from wpwebsitecreator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator allows Stored XSS.This issue affects Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: from n/a through <= 4.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpwebsitecreator | Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera | 0 – through 4.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L