← CVE Intelligence

CVE-2021-24514

Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting PUBLISHED

Description (CNA)

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed

Affected (CNA)

Vendor / productVersions
Unknown / Visual Form Builderaffected 3.0.4 before 3.0.4

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.