CVE-2017-20192: strategy11 formidable_form_builder Cross-site Scripting

Vulnerability summary

CVE-2017-20192 is a high (CVSS 8.3) Cross-site Scripting vulnerability in strategy11 formidable_form_builder. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-10-2024
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.