CVE-2024-0618: 
WordPress vulnerability analysis and mitigation

The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms is affected by a Stored Cross-Site Scripting vulnerability (CVE-2024-0618) in versions up to and including 5.1.5. The vulnerability exists due to insufficient input sanitization and output escaping in imported form titles (NVD, Advisory).

The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts via imported form titles. The issue specifically affects multi-site installations and installations where unfiltered_html has been disabled. The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, the vulnerability allows authenticated attackers with administrator-level permissions to inject malicious web scripts that will execute whenever a user accesses the affected page. This could potentially lead to client-side attacks against users viewing the compromised pages (Advisory).

The vulnerability has been patched in version 5.1.7 of the Fluent Forms plugin. Users are advised to update to the latest version to mitigate this security risk (NVD).