CVE-2024-10909

CVE-2024-10909 is a medium-severity vulnerability affecting the Pojo Forms plugin for WordPress, versions up to and including 1.4.7. It allows authenticated attackers with Subscriber-level access to execute arbitrary shortcodes due to insufficient validation in the form_preview_shortcode AJAX action. The CVSS score is 6.3, indicating a network-exploitable vulnerability with low attack complexity and potential for low impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.