CVE-2024-10909
Published
CVSS v3
6.3
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. This was partially fixed in version 1.4.8.
<p><strong>Please Note:</strong> This plugin is for <a href="http://pojo.me/?utm_source=wp-repo&utm_medium=link&utm_campaign=forms" rel="nofollow ugc">Pojo Framework</a> users only.</p>
<p>Pojo Forms is the ultimate form creation solution for WordPress sites that work with Pojo Framework. It allows you to easily and quickly design complex forms through a drag and drop interface and all this with no CSS knowledge or coding required.</p>
<p><strong>Field Type (HTML5):</strong></p>
<ul>
<li>Text</li>
<li>Textarea</li>
<li>Email</li>
<li>URL</li>
<li>Tel</li>
<li>Checkbox</li>
<li>Radio</li>
<li>Drop-down (Select)</li>
<li>Number</li>
<li>Button</li>
<li>Upload File</li>
</ul>
<p>Here are just a few of the things you will find in Pojo Forms:</p>
<ul>
<li>Set required fields</li>
<li>Set placeholder</li>
<li>3 sizes for Field or Button</li>
<li>Custom style for fields and button</li>
<li>Add form data to submition (time, date, page URL, user agant, IP)</li>
<li>After submitting redirect to custom URL</li>
<li>Add a custom CSS class for each field</li>
<li>Set field width (6 columns)</li>
<li>Spam Filter – Integretion with Akismet plugin.</li>
<li>Submit your form by reloading the page or asynchronously with AJAX.</li>
</ul>
<p>You can place any form in any page or widget by embedding it in the Text Editor with a unique shortcode:</p>
<pre><code>[pojo-form id="ID"]
</code></pre>
<p><strong>Contributions:</strong></p>
<p>Would you like to like to contribute to Pojo Forms? You are more than welcome to submit your requests on the <a href="https://github.com/pojome/pojo-forms" rel="nofollow ugc">GitHub repo</a>. Also, if you have any notes about the code, please open a ticket on this issue tracker.</p>
WordPress Plugin Directory