CVE-2021-24505: Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-09 · updated 2026-06-17
Weakness: CWE-79

Description

The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.

Affected products

Forms: before 1.12.3 — fixed in 1.12.3

How to fix

Upgrade to a fixed version: Forms 1.12.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/550e08ac-4c3a-4e22-8e98-bc5bfc020ca9
https://wpscan.com/vulnerability/550e08ac-4c3a-4e22-8e98-bc5bfc020ca9

Get alerted when CVE-2021-24505 or the next vulnerability affects your stack