WordPress Tripetto Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Tripetto WordPress plugin, which is used for creating contact forms, surveys, and quizzes. This vulnerability exists in all versions up to and including 8.0.9. It arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to upload attachments that inject arbitrary scripts. These scripts execute when users access the uploaded files.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the file.

Remediation

Users are advised to update the Tripetto WordPress plugin to version 8.0.10 or later.