CVE-2023-6830

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68318.1Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-68324.3Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-68334.4Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive info CVE-2023-68355.3Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could CVE-2023-68367.5Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us CVE-2023-68378.2Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerabil CVE-2023-68386.1Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both auth CVE-2023-68395.3Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in th CVE-2023-68406.7An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 w CVE-2023-68417.5A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repe CVE-2023-68424.8The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stor CVE-2023-68434.3The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 d