VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Nov 6, 2024· Updated Jun 17, 2026

CVE-2024-10647

CVE-2024-10647

Description

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Westguardsolutions/Ws Form
    cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:*
    Range: <1.9.245
  • WordPress/WS Form LITEllm-fuzzy2 versions
    <=1.9.244+ 1 more
    • (no CPE)range: <=1.9.244
    • (no CPE)
  • westguard/WS Form LITE – Drag & Drop Contact Form Builderv5
    Range: 0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.