CVE-2023-4950 Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

What is CVE-2023-4950?

CVE-2023-4950 is a medium-severity cross-site scripting vulnerability in Unknown Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor, published on 16 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

Which versions are affected by CVE-2023-4950?

It affects 1 product.

Products include Funnelforms Funnelforms.

How do I fix CVE-2023-4950?

No fix has been published for CVE-2023-4950 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-4950 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4950 exists.

Other vulnerabilities in Unknown Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor

• CVE-2023-5382 Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion Medium 6.5
• CVE-2023-5386 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion Medium 6.5
• CVE-2023-5383 Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication Medium 4.3
• CVE-2023-5385 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication Medium 4.3
• CVE-2023-5387 Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2q77-j9qq-67hg.