CVE-2021-24896

Published on: 12/13/2021 12:00:00 AM UTC

Last Modified on: 12/15/2021 09:07:00 PM UTC

CVE-2021-24896

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Certain versions of Caldera Forms from Calderaforms contain the following vulnerability:

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVE-2021-24896 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.
Affected Vendor/Software: Unknown - Caldera Forms – More Than Contact Forms version < 1.9.5

CVSS3 Score: 4.8 - MEDIUM

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	HIGH	REQUIRED
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
CHANGED	LOW	LOW	NONE

CVSS2 Score: 3.5 - LOW

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	MEDIUM	SINGLE
Confidentiality Impact	Integrity Impact	Availability Impact
NONE	PARTIAL	NONE

CVE References

Description	Tags ^ⓘ	Link
Attention Required! \| Cloudflare	wpscan.com text/html Inactive LinkNot Archived	MISC wpscan.com/vulnerability/2c469e8b-c761-460b-b31d-9219a43006ff

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Calderaforms	Caldera Forms	All	All	All	All

cpe:2.3:a:calderaforms:caldera_forms:*:*:*:*:*:wordpress:*:*:

Discovery Credit

Dhananjay Garg

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2021-24896 : The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before… twitter.com/i/web/status/1…	2021-12-13 10:54:54
/r/netcve	CVE-2021-24896	2021-12-13 11:38:46