CVE-2022-0830
Assigner: WPScan
Published: 2022-04-04T15:35:50
State: PUBLISHED
affected: product: FormBuilder
vendor: Unknown
versions: lessThanOrEqual: 1.08
status: affected
version: 1.08
versionType: custom
credits: value: Chiragh Arora
descriptions: value: The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
title: FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF
x_generator: WPScan CVE Generator