CVE-2024-6243: Linksoftwarellc Html Forms

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.

Affected products

• Linksoftwarellc Html Forms: before 1.3.33 (fixed in 1.3.33)

Published 2024-07-22. Last modified 2026-06-17.