Input validation vulnerability in Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions 2.8.1

The Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms plugin for WordPress is vulnerable to malicious attacks in versions up to and including 2.8.1. This is because of a lack of security measures on the user-supplied attributes of the plugin’s shortcode(s). This means that if an authenticated attacker with contributor-level or higher permissions can inject malicious web scripts into pages. These scripts will be executed every time a user visits the injected page.