Stored XSS in Free Builder for Elementor WordPress Plugin

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Free Builder for Elementor WordPress plugin before version 1.6.7. It occurs because the plugin does not sanitize user-submitted contact form field values before storing them. When a logged-in administrator views these form submissions in the admin dashboard, the injected malicious scripts execute.

Useful 0 Not Useful 0

Detection Guidance

Check if the Free Builder for Elementor plugin version is below 1.6.7. Inspect form submissions in the admin dashboard for unusual scripts or payloads. Use WordPress security plugins to scan for stored XSS attempts.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to inject malicious scripts into form submissions. When an administrator views these submissions, the scripts execute, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of trust if such incidents occur.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Free Builder for Elementor plugin to version 1.6.7 or later immediately. Review stored form submissions for malicious scripts and remove any suspicious entries.

Useful 0 Not Useful 0