Input validation vulnerability in Flo Forms – Easy Drag & Drop Form Builder 1.0.35

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This attack can be performed by using the flo_import_forms_options AJAX action in versions up to and including 1.0.35. This is because the plugin does not properly sanitize user input, escape output, or check user capabilities. As a result, any user with an account, such as a subscriber, can inject malicious web scripts into web pages that will be executed each time a user views the page.