CVE-2024-0386

Deeper analysis

The weForms plugin for WordPress is vulnerable to stored cross-site scripting in all versions through 1.6.21. The flaw stems from insufficient sanitization and escaping of the HTTP Referer header, which is processed and stored without adequate validation before being rendered in administrative or other pages.

Unauthenticated remote attackers can supply a crafted Referer header to inject persistent JavaScript payloads. Because the attack requires no authentication or user interaction and affects the application scope, successful exploitation allows arbitrary script execution in victims' browsers, enabling theft of session tokens, administrative actions, or other client-side impacts rated at CVSS 7.2.

Public references point to a WordPress plugin changeset that addresses the issue, indicating that updating beyond version 1.6.21 removes the vulnerable code paths. Wordfence threat intelligence entries reiterate the same remediation guidance and confirm the affected versions.

EPSS for the CVE rose from an initial low value to a peak of 0.1576, indicating measurable post-disclosure interest in exploitation. No confirmed in-the-wild campaigns are documented in the supplied references.