CVE-2023-3645
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Risk Assessment
The organization may be exposed to XSS attacks that could lead to data theft or admin account takeover, jeopardizing the security of the entire site.
Recommendation
It is recommended to update the plugin to version 2.2.0 or later to mitigate this vulnerability and review security settings to minimize risk.
Original NVD description (English source)
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)