CVE-2024-11934: 
WordPress vulnerability analysis and mitigation

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin is affected by a Stored Cross-Site Scripting vulnerability (CVE-2024-11934) in versions up to and including 2.1.3.2. The vulnerability was discovered by Peter Thaleikis and publicly disclosed on January 6, 2025 (NVD, Wordfence).

The vulnerability stems from insufficient input sanitization and output escaping of the 'address' parameter in the plugin. It has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The weakness is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft or manipulation of user interactions (NVD).

As of January 2, 2025, the plugin has been closed and is no longer available for download from the WordPress plugin repository due to this security issue. Users are advised to remove the plugin from their WordPress installations (WordPress Plugin).