CVE Database /
CVE-2024-13403
CVE · Medium
CVE-2024-13403 — WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.3.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-13403
|
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.3.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 1.9.3.2
|
1.9.3.2 |
2025-02-03 |
—
|
CVE-2024-13403
The WPForms plugin through version 1.9.3.1 contains a stored cross-site scripting vulnerability in the fieldHTML parameter caused by inadequate sanitization of input and escaping of output. Authenticated users with Contributor privileges or higher can inject malicious scripts that persist in pages and execute for any visitor accessing those pages. The vulnerability affects all versions up to and including 1.9.3.1, with a fix available in version 1.9.3.2 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings