XSS in 10web Form Maker By – Mobile-friendly Drag & Drop Contact Builder
CVE-2024-5020
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on u…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (69.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- 10web Form Maker By – Mobile-friendly Drag & Drop Contact Builder — versions 0
- Bqworks Accordion Slider — versions 0
- Colorlibplugins Fancybox For Wordpress — versions 0
- Dfactory Responsive Lightbox & Gallery — versions 0
- Easy Social Feed Premium — versions 0
- Extendthemes Colibri Page Builder — versions 0
- Firelightwp Firelight Lightbox — versions 0
- Foliovision Fv Flowplayer Video Player — versions 0
- Jetmonsters Getwid – Gutenberg Blocks — versions 0
- Nko Visual Portfolio, Photo Gallery & Post Grid — versions 0
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa…
- plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view
- plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder
- plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery
- plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite
- plugins.trac.wordpress.org/changeset/3156791/form-maker
- plugins.trac.wordpress.org/changeset/3160432/visual-portfolio
- plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer
- plugins.trac.wordpress.org/changeset/3160232/easy-fancybox
- plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free
Frequently asked questions
- What is CVE-2024-5020?
- CVE-2024-5020 is a medium-severity vulnerability in 10web Form Maker By – Mobile-friendly Drag & Drop Contact Builder, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2024-12-04.
- How severe is CVE-2024-5020?
- Medium severity. CVSS v3 base score is 6.4 out of 10.