CVE-2024-6770

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 31, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-67728.8Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory accessCVE-2024-67738.8Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruptionCVE-2024-67748.8Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specifCVE-2024-67758.8Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specificCVE-2024-67768.8Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2024-67776.5Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extensCVE-2024-67787.5Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injecCVE-2024-67799.6Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escapeCVE-2024-67803.3Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.CVE-2024-67817.5Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.CVE-2024-67829.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.CVE-2024-67834.8A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the pr
CVE-2024-6770: High severity, CVSS 7.2 | Vulnix