Stored Cross-Site Scripting in Repeater Fields for Elementor Forms

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7. The vulnerability stems from insufficient input sanitization and output escaping within the plugin's handling of repeater field values. This flaw allows unauthenticated remote attackers to inject malicious JavaScript into form entries stored by the plugin. When an administrator or another user views the submitted form data within the WordPress dashboard or a front-end display, the injected script executes in the context of the victim's session. This can lead to unauthorized actions performed on behalf of the victim, session hijacking, or defacement of the affected WordPress site.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users viewing the injected content. This poses a significant risk to site integrity and user security, potentially facilitating account takeover or unauthorized administrative actions. The vulnerability affects all users running plugin versions 2.2.7 and earlier.

Recommendation

Update the Repeater Fields for Elementor Forms plugin to the latest available version (beyond 2.2.7) to patch the underlying sanitization flaw. Monitor web server logs for HTTP POST requests directed at form submission endpoints that contain suspicious script tags or JavaScript event handlers.