CVE-2023-0546 FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field

What is CVE-2023-0546?

CVE-2023-0546 is a medium-severity cross-site scripting vulnerability in Unknown Contact Form Plugin, published on 10 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.

Which versions are affected by CVE-2023-0546?

It affects 1 product.

Products include Fluentforms Contact Form.

How do I fix CVE-2023-0546?

No fix has been published for CVE-2023-0546 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0546 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0546 exists.

Other vulnerabilities in Unknown Contact Form Plugin

• CVE-2024-2771 Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Critical 9.8
• CVE-2022-3463 FluentForm < 4.3.13 - CSV Injection Critical 9.8
• CVE-2021-34620 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation High 8.8
• CVE-2024-4157 Deserialization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder High 7.5
• CVE-2024-2782 Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hx6c-3qpr-f44p.