Threats tagged 'ghsa-755c-vvf8-fm4g'

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the '_elementor_data.form_fields[].custom_id' parameter. This affects all versions up to and including 2.7.9. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability bypasses the esc_html() sanitization due to the way the plugin's frontend script processes HTML fragments with jQuery.