Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as ...

CVE-2023-0546 · published 3 years ago
Summary

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the...

What to do
  • Update fluentforms contact_form to version 4.3.25 or later.
Affected software
VendorProductAffected versions
fluentforms contact_form < 4.3.25
cpe:2.3:a:fluentforms:contact_form:*:*:*:*:*:wordpress:*:*
Original advisory text
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as ...
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published10 Apr 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-0546 · NVD
Track software like this
Free during beta