WPForms Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in WPForms version 1.7.8. The issue arises in the slider import search feature and the tab parameter, allowing attackers to inject malicious scripts through the ListTable.php endpoint. This injection can execute arbitrary JavaScript in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the ListTable.php endpoint with the tab parameter set to include a script tag. The injected script will be executed in the browser of the user accessing the vulnerable WPForms instance.