CVE-2024-2030
Last modified
CVE-2024-2030 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-2030?
How severe is CVE-2024-2030?
How do I fix CVE-2024-2030?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-20294A vulnerability in the Link Layer Discovery Protocol (LLDP) …6.6
- CVE-2024-20295A vulnerability in the CLI of the Cisco Integrated Managemen…8.8
- CVE-2024-20296A vulnerability in the web-based management interface of Cis…7.2
- CVE-2024-20297A vulnerability in the AnyConnect firewall for Cisco Adaptiv…5.8
- CVE-2024-20298A vulnerability in the web-based management interface of Cis…5.4
- CVE-2024-20299A vulnerability in the AnyConnect firewall for Cisco Adaptiv…5.8
- CVE-2024-20300A vulnerability in the web-based management interface of Cis…5.4
- CVE-2024-20301A vulnerability in Cisco Duo Authentication for Windows Logo…6.2
- CVE-2024-20302A vulnerability in the tenant security implementation of Cis…4.3
- CVE-2024-20303A vulnerability in the multicast DNS (mDNS) gateway feature …7.4
- CVE-2024-20304A vulnerability in the multicast traceroute version 2 (Mtrac…7.5
- CVE-2024-20305A vulnerability in the web-based management interface of Cis…4.8
Are you affected by CVE-2024-2030?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST