CVE-2024-3113: 
WordPress vulnerability analysis and mitigation

The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before version 2.12.2 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists due to insufficient sanitization and escaping of plugin settings (WPScan, NVD).

The vulnerability allows high privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The issue stems from improper sanitization and escaping of form settings. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (WPScan).

When successfully exploited, the vulnerability allows attackers with administrative privileges to inject malicious JavaScript code that executes in the context of other users' browsers when they view the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users (WPScan).

The vulnerability requires an attacker to have administrative privileges on the WordPress installation. A proof of concept exists demonstrating how the vulnerability can be exploited by injecting malicious JavaScript code through the form creation interface (WPScan).

The vulnerability has been fixed in version 2.12.2 of the FormFlow plugin. Users are advised to update to this version or later to protect against this security issue (WPScan).