Threats tagged 'ghsa-r9jp-6895-gxwc'

The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) via a user-defined hidden input parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views a specific submissions page and interacts with a crafted entry. The flaw arises from insufficient input sanitization and output escaping in the handling of the 'wdform_<n>_element<id>' parameter. Exploitation requires an administrator to trigger the vulnerable functionality, leveraging their session and embedded nonce.