CVE-2024-3113

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-311346.5In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratio CVE-2024-311356.1In JetBrains TeamCity before 2024.03 open redirect was possible on the login page CVE-2024-311367.4In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter CVE-2024-311376.1In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration CVE-2024-311385.4In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings CVE-2024-311398.1In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector CVE-2024-31146.5An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to CVE-2024-311404.9In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools CVE-2024-311416.5Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clie CVE-2024-311427.5Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-43 CVE-2024-311437.5An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, t CVE-2024-311443.8For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains