CVE-2024-13377

CVE-2024-13377 is a stored cross-site scripting (XSS) vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.9.1.3. The flaw stems from insufficient input sanitization and output escaping of the 'alt' parameter, allowing arbitrary web scripts to be injected into pages. It is classified under CWE-79 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and changed scope.

Unauthenticated attackers can exploit this vulnerability remotely by submitting malicious payloads via the 'alt' parameter, which get stored and rendered on affected pages. When any user, including administrators, accesses these injected pages, the scripts execute in their browser context, potentially leading to session hijacking, data theft, or further site compromise through low confidentiality and integrity impacts.

Mitigation details are available in the Gravity Forms change log at https://docs.gravityforms.com/gravityforms-change-log/, which documents patches in versions beyond 2.9.1.3, and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/03623f00-2c3c-4590-92fe-a5eaac15b944?source=cve, recommending immediate updates to the latest plugin version.