CVE-2023-3248

Summary

CVE-2023-3248 is a vulnerability affecting the All-in-one Floating Contact Form plugin for WordPress. Before version 2.1.2, the plugin fails to sanitize and escape certain settings, enabling high privilege users like admins to execute Stored Cross-Site Scripting attacks. This issue can bypass the disallowed unfiltered_html capability in multisite setups.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.