Vulnerabilities > CVE-2023-0710 - Unspecified vulnerability in Wpmet Metform Elementor Contact Form Builder

CVSS 5.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

wpmet

NVD

Published: 2023-06-09

Updated: 2024-11-21

Summary

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.

Vulnerable Configurations

Part	Description	Count
Application	Wpmet Wpmet Metform Elementor Contact Form Builder 1.1 Wpmet Metform Elementor Contact Form Builder 1.1.2 Wpmet Metform Elementor Contact Form Builder 1.1.3 Wpmet Metform Elementor Contact Form Builder 1.1.4 Wpmet Metform Elementor Contact Form Builder 1.1.5 Wpmet Metform Elementor Contact Form Builder 1.1.8 Wpmet Metform Elementor Contact Form Builder 1.1.9 Wpmet Metform Elementor Contact Form Builder 1.2.0 Wpmet Metform Elementor Contact Form Builder 1.2.1 Wpmet Metform Elementor Contact Form Builder 1.2.2 Wpmet Metform Elementor Contact Form Builder 1.2.3 Wpmet Metform Elementor Contact Form Builder 1.2.11 Wpmet Metform Elementor Contact Form Builder 1.3.0 Wpmet Metform Elementor Contact Form Builder 1.3.1 Wpmet Metform Elementor Contact Form Builder 1.3.2 Wpmet Metform Elementor Contact Form Builder 1.3.3 Wpmet Metform Elementor Contact Form Builder 1.3.4 Wpmet Metform Elementor Contact Form Builder 1.3.5 Wpmet Metform Elementor Contact Form Builder 1.3.6 Wpmet Metform Elementor Contact Form Builder 1.3.7 Wpmet Metform Elementor Contact Form Builder 1.3.8 Wpmet Metform Elementor Contact Form Builder 1.3.9 Wpmet Metform Elementor Contact Form Builder 1.3.10 Wpmet Metform Elementor Contact Form Builder 1.3.12 Wpmet Metform Elementor Contact Form Builder 1.3.13 Wpmet Metform Elementor Contact Form Builder 1.3.14 Wpmet Metform Elementor Contact Form Builder 1.3.15 Wpmet Metform Elementor Contact Form Builder 1.3.16 Wpmet Metform Elementor Contact Form Builder 1.3.17 Wpmet Metform Elementor Contact Form Builder 1.4.0 Wpmet Metform Elementor Contact Form Builder 1.4.1 Wpmet Metform Elementor Contact Form Builder 1.4.2 Wpmet Metform Elementor Contact Form Builder 1.4.3 Wpmet Metform Elementor Contact Form Builder 1.4.4 Wpmet Metform Elementor Contact Form Builder 1.4.5 Wpmet Metform Elementor Contact Form Builder 1.4.6 Wpmet Metform Elementor Contact Form Builder 1.4.7 Wpmet Metform Elementor Contact Form Builder 1.4.8 Wpmet Metform Elementor Contact Form Builder 1.4.9 Wpmet Metform Elementor Contact Form Builder 1.4.10 Wpmet Metform Elementor Contact Form Builder 1.5.0 Wpmet Metform Elementor Contact Form Builder 1.5.1 Wpmet Metform Elementor Contact Form Builder 1.5.2 Wpmet Metform Elementor Contact Form Builder 1.5.3 Wpmet Metform Elementor Contact Form Builder 1.5.4 Wpmet Metform Elementor Contact Form Builder 1.5.5 Wpmet Metform Elementor Contact Form Builder 1.5.6 Wpmet Metform Elementor Contact Form Builder 1.6.0 Wpmet Metform Elementor Contact Form Builder 2.0.0 Wpmet Metform Elementor Contact Form Builder 2.0.1 Wpmet Metform Elementor Contact Form Builder 2.1.0 Wpmet Metform Elementor Contact Form Builder 2.1.1 Wpmet Metform Elementor Contact Form Builder 2.1.2 Wpmet Metform Elementor Contact Form Builder 2.1.3 Wpmet Metform Elementor Contact Form Builder 2.1.4 Wpmet Metform Elementor Contact Form Builder 2.1.5 Wpmet Metform Elementor Contact Form Builder 2.1.6 Wpmet Metform Elementor Contact Form Builder 2.2.0 Wpmet Metform Elementor Contact Form Builder 2.2.1 Wpmet Metform Elementor Contact Form Builder 3.0.0 Wpmet Metform Elementor Contact Form Builder 3.0.1 Wpmet Metform Elementor Contact Form Builder 3.1.0 Wpmet Metform Elementor Contact Form Builder 3.1.1 Wpmet Metform Elementor Contact Form Builder 3.1.2 Wpmet Metform Elementor Contact Form Builder 3.2.0 Wpmet Metform Elementor Contact Form Builder 3.2.1 Wpmet Metform Elementor Contact Form Builder 3.2.2 Wpmet Metform Elementor Contact Form Builder 3.2.3 Wpmet Metform Elementor Contact Form Builder 3.2.4 Wpmet Metform Elementor Contact Form Builder 3.3.0	70

Summary

Vulnerable Configurations

References