CVE-2023-35095
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Flothemes Flo Forms plugin versions up to 1.0.40 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of administrative users.
Risk Assessment
This vulnerability could lead to the takeover of administrator accounts and allow attackers to perform unauthorized actions within the system. This may result in serious consequences for data security and application integrity.
Recommendation
It is recommended to update the Flothemes Flo Forms plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify potential threats is advisable.
Original NVD description (English source)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions.