Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
Why it matters now
EPSS 0.01523 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Form Store to DB (Unknown): 1.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Form Store to DB | 1.1.1 to before 1.1.1 | 1.1.1 | Patch available | CNA |
- Form Store to DB VendorUnknown Affected 1.1.1 to before 1.1.1 Fixed in 1.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:accesspressthemes:form_store_to_db:*:*:*:*:*:wordpress:*:* | before 1.1.1 | Vulnerable | AccessPress Themes |
- cpe:2.3:a:accesspressthemes:form_store_to_db:*:*:*:*:*:wordpress:*:* Versions before 1.1.1 Vulnerable ·AccessPress Themes
Remediation
- Fix · CNA Form Store to DB (Unknown) Fixed in 1.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25107
- 2026-10-03 Alias added: GHSA-796r-rh39-cjqr
References
More AccessPress Themes Form Store To Db vulnerabilities
- TI-2021-07149 Backdoored Plugins & Themes from AccessPress Themes CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-25107 · CVE Program
- CVE-2021-25107 · NVD
- FIRST EPSS
- GHSA-796r-rh39-cjqr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences