CVE-2018-7747 Caldera Forms <= 1.5.9.1 - Cross Site Scripting
MediumCVSS 4.8
EPSS 4.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| calderalabs caldera forms | <= 1.5.9 | No fix listed |
| wordpress caldera-forms(WordPress) | < 1.6.0 | 1.6.0 |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- calderaforms.com release-notes
- calderaforms.com release-notes vendor-advisory
- wordpress.org product release-notes
- 44489 exploit third-party-advisory vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org