{"id":"CVE-2024-10504","aliases":["EUVD-2025-15343","GHSA-q4jv-p3r8-p9rx"],"status":"published","title":"ARForms Builder \u003c 1.7.1 - Unauthenticated Stored XSS","description":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00344,"percentile":0.28237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-05-15T20:06:44Z","modified":"2026-06-17T06:55:49Z","products":[{"vendor":"reputeinfosystems","product":"arforms"},{"vendor":"unknown","product":"contact form, survey, quiz \u0026 popup form builder"}],"references":[{"url":"https://wpscan.com/vulnerability/9a22df11-0e24-4248-a8f3-da8f23ccb313/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10504"},{"url":"https://wpscan.com/vulnerability/9a22df11-0e24-4248-a8f3-da8f23ccb313"},{"url":"https://github.com/advisories/GHSA-q4jv-p3r8-p9rx"}],"sources":{"cve":[{"id":"CVE-2024-10504","title":"ARForms Builder \u003c 1.7.1 - Unauthenticated Stored XSS","description":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2025-05-15T20:06:44.219Z","modified":"2025-05-20T15:31:47.781Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2025-15343","description":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2025-05-15T20:06:44Z","modified":"2025-05-20T15:31:47Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:43.363755Z"}],"ghsa":[{"id":"GHSA-q4jv-p3r8-p9rx","title":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not...","description":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2025-05-15T21:31:28Z","modified":"2025-06-04T21:32:08Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:34.475579Z"}],"nvd":[{"id":"CVE-2024-10504","description":"The Contact Form, Survey, Quiz \u0026 Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2025-05-15T20:15:33.297Z","modified":"2026-06-17T06:55:49.073Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:46.40251Z"}]}}