https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:58:06.202743+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-0546 CVE-2023-0546 — FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field 2026-10-06T20:58:06.218221+00:00

Affected: Unknown Contact Form Plugin

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.