Description
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor | < 3.4 | 3.4 |
References
- https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58 exploit vdb-entry technical-description