Loading vulnerability…
Stored XSS in Flo Forms WordPress Plugin (flo_import_forms_options)
A vulnerability in the Flo Forms – Easy Drag & Drop Form Builder WordPress plugin (versions <= 1.0.35) allows authenticated users, such as subscribers, to perform stored cross-site scripting (XSS) attacks via the flo_import_forms_options AJAX action. The vulnerability is due to insufficient input sanitization, lack of output escaping, and missing capability checks, enabling attackers to inject arbitrary JavaScript into pages.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows authenticated attackers to inject persistent JavaScript code into WordPress pages, which will execute in the context of any user viewing the affected page. This can lead to session hijacking, defacement, or further compromise of site users.
If you can’t patch tonight, do this now.
Restrict access to the WordPress admin area to trusted users only, and consider disabling or removing the Flo Forms plugin until a patched version is available. Employ a web application firewall (WAF) to help block malicious requests targeting this vulnerability.
Patch, then assume compromise.
Update the Flo Forms plugin to a version after 1.0.35 where proper input sanitization, output escaping, and capability checks are implemented for the flo_import_forms_options AJAX action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.