Back Sploitus

CVE-2017-20192-formidable

Sploitus • September 23, 2026

Share: View original

##

# CVE-2017-20192 — Formidable Forms (WordPress) — Уязвимая Docker-лаборатория

Воспроизводимая Docker-лаборатория для **CVE-2017-20192** (Formidable Forms < 2.05.03, хранимый XSS).

## Проверка (вспомогательный скрипт лаборатории)

* отправляет специально сформированную запись **без аутентификации**

* выполняет вход как администратор WordPress

* получает страницу просмотра записей администратора Formidable и проверяет наличие сохранённого маркера

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Vulnerabilities Discovered in Kubernetes and WordPress Two significant vulnerabilities have been reported: CVE-2024-10220 and CVE-2017-20192. CVE-2024-10220 affects gitRepo volumes in Kubernetes, allowing arbitrary command execution on Kubernetes nodes. This vulnerability was published on November 22, 2024, with a proof-of-concept (PoC) available since November 21, 2024. The testing repository is part of security research at the University of Central Oklahoma, but it contains a malicious Git hook and should not be used in production. CVE-2017-20192, related to Formidable Forms in WordPress, allows stored XSS attacks and was published on October 16, 2024. A PoC for this vulnerability is expected to be publicly available by December 24, 2025. Both vulnerabilities pose risks to their respective platforms, with CVE-2024-10220 being particularly critical due to its potential for remote command execution. 2 sources 55

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Cwe-79 - Cross-site Scripting (xss)

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (1)

Vulnerabilities (1)