westguard vulnerabilities and threats

WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress versions up to 1.12.18 is vulnerable to stored cross-site scripting (XSS) via the 'field_<id>[0][0]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page. The issue stems from the client-side esc_html() helper improperly handling non-string values, enabling malicious payloads to reach jQuery .append() unescaped.

The WS Form LITE – Drag & Drop Contact Form Builder WordPress plugin up to version 1.10.80 is vulnerable to PHP Object Injection via deserialization of untrusted form submission meta values. This vulnerability allows unauthenticated attackers to inject PHP objects. However, exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme. Without such a POP chain, this vulnerability has no impact. If a suitable POP chain exists, attackers could potentially delete files, access sensitive data, or execute arbitrary code.

The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is partially fixed in 1.10.13 and completely fixed in 1.10.14.

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.