CVE-2023-4950: Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-10-16 · updated 2026-06-17

Description

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

Affected products

funnelforms Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: before 3.4 — fixed in 3.4

How to fix

Upgrade to a fixed version: funnelforms Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free 3.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58
https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58

Get alerted when CVE-2023-4950 or the next vulnerability affects your stack