Fluent Forms up to 6.1.14 leaks the plugin's admin AJAX nonce to every logged-in user on form preview pages, and the AI Form Builder endpoint only validated that nonce instead of checking a capability. A Subscriber-level attacker can therefore drive AI form generation and have the returned bare JavaScript stored as the form's custom JS, which then... Weiterlesen
Intelligence View
⚡ tsecurity.de Intelligence
Stored Cross-Site Scripting in Fluent Forms AI Form Builder
Fluent Forms up to 6.1.14 leaks the plugin's admin AJAX nonce to every logged-in user on form preview pages, and the AI Form Builder endpoint only validated that nonce instead of checking a capability. A Subscriber-level attacker can…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR