CVE-2018-14430

NONE EPSS 65.8%

Published Jul 25, 20187y ago · Modified Jun 17, 20262w ago

Published Jul 25, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.

Threat Intelligence

EPSS Exploit Probability

65.8% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
mondula	multi_step_form	*	≤1.2.5

References 2

hackpuntes.com https://hackpuntes.com/cve-2018-14430-wordpress-plugin-multi-step-form-125-multiples-xss-reflejados/

ExploitIssue TrackingThird Party Advisory
wpvulndb.com https://wpvulndb.com/vulnerabilities/9106

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.