CVE Catalog
CVE-2023-3134
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk3.54%
88th percentile - higher than 88% of all known CVEs
Summary
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
Risk Assessment
An attacker could exploit this vulnerability to carry out XSS attacks, potentially resulting in the theft of user data or session hijacking.
Recommendation
It is recommended to update the Forminator plugin to version 1.24.4 or later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.