{"id":"CVE-2018-14430","aliases":["EUVD-2018-6347","GHSA-pcm9-888p-jp88","MGASA-2018-0388"],"status":"published","title":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1]...","description":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01255,"percentile":0.6968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-07-25T23:00:00Z","modified":"2026-06-17T01:40:58Z","affected":[{"source":"osv","ecosystem":"Mageia:6","package":"libextractor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-1.mga6"}]}],"bundled":3}],"products":[{"vendor":"mondula","product":"multi_step_form"}],"references":[{"url":"https://hackpuntes.com/cve-2018-14430-wordpress-plugin-multi-step-form-125-multiples-xss-reflejados/","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://wpvulndb.com/vulnerabilities/9106","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14430"},{"url":"https://github.com/advisories/GHSA-pcm9-888p-jp88"},{"url":"https://advisories.mageia.org/MGASA-2018-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23559","tags":["report"]},{"url":"https://www.debian.org/security/2018/dsa-4290","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-14430","description":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.","status":"published","published":"2018-07-25T23:00:00Z","modified":"2024-08-05T09:29:51.619Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6347","description":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.","status":"published","published":"2018-07-25T23:00:00Z","modified":"2024-08-05T09:29:51Z","updated_at":"2026-11-03T02:39:46.696329Z"}],"ghsa":[{"id":"GHSA-pcm9-888p-jp88","title":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1]...","description":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.","status":"published","published":"2022-05-14T02:58:57Z","modified":"2023-02-02T05:06:42Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:21.13569Z"}],"nvd":[{"id":"CVE-2018-14430","description":"The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.","status":"published","published":"2018-07-25T23:29:00.337Z","modified":"2026-06-17T01:40:58.66Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"MGASA-2018-0388","title":"Updated libextratcor packages fix security vulnerability","description":"Several vulnerabilities were discovered in libextractor which may lead to\ndenial of service or the execution of arbitrary code if a specially\ncrafted file is opened (CVE-2018-14346, CVE-2018-14347, CVE-2018-16430).\n","status":"published","published":"2018-09-21T16:26:22Z","modified":"2026-04-16T06:25:12.779386161Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}