Authenticated (Contributor+) Stored Cross-Site Scripting via CF7 and Gravity Forms Styler Form ID

The Contact Form 7 and Gravity Forms styler blocks used the formId block attribute directly, concatenating it into a shortcode string that is then echoed. A user able to insert or edit a block (Contributor and above) could set formId to a value that breaks out of the shortcode, causing arbitrary HTML or script to be rendered for anyone viewing the... Weiterlesen