CVE-2023-3645

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Contact Form Builder by Bit Form	< 2.2.0

References

https://wpscan.com/vulnerability/58c11f1e-6ea0-468c-b974-4aea9eb94b82Exploit, Third Party Advisory
https://wpscan.com/vulnerability/58c11f1e-6ea0-468c-b974-4aea9eb94b82Exploit, Third Party Advisory

Timeline

Published: Aug 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364567.3authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwar CVE-2023-364578.81Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craf CVE-2023-364588.81Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craf CVE-2023-364596.1Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and CVE-2023-36467.5On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel p CVE-2023-364609.9Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364617.5Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout o CVE-2023-364625.4Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364636.1Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connect CVE-2023-364645.5pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__par CVE-2023-364657.1Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2023-364664.3Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic titl