CVE-2020-36919

Name of the Vulnerable Software and Affected Versions WPForms version 1.7.8

Description The software contains a cross-site scripting issue in the slider import search feature and tab parameter. An attacker can inject malicious scripts through the /ListTable.php endpoint to execute arbitrary JavaScript in a victim’s browser. The vulnerable parameter is tab.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /ListTable.php endpoint to minimize the risk of exploitation.