CVE-2023-6953

The PDF Generator For Fluent Forms plugin for WordPress through version 1.1.7 contains a stored cross-site scripting vulnerability in the header, PDF body, and footer content parameters because user input is not adequately sanitized or escaped on output. An attacker with the ability to create forms—which may be set to contributor level or higher depending on administrator configuration, though defaulting to admin—could inject malicious scripts that execute when users view the affected page. The vulnerability was patched in version 1.1.8.

Based on public CVE data (MITRE/NVD).