CVE-2024-48037

CVE-2024-48037 concerns the WordPress plugin Contact Form Widget (Contact Form Widget: Contact Query, Contact Page, Form Maker, Query Table) with versions 1.4.2 and earlier. The vulnerability is a CSRF flaw that could allow unauthorized state-changing requests from authenticated or possibly unaut...

CVE-2024-48037 WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through = 1.4.2...

CVE-2024-48037 WordPress Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table plugin <= 1.4.2 - CSRF vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through 1.4.2...

WordPress plugin Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-32938 · Unknown · Contact Form 7 – Paypal & Stripe Add-On

Name of the Vulnerable Software and Affected Versions: Contact Form 7 – PayPal & Stripe Add-on versions n/a through 2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. There is...

PT-2024-32965 · Supsystic · Contact Form By Supsystic

Name of the Vulnerable Software and Affected Versions: Contact Form by Supsystic versions 1.7.28 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendation...

WordPress plugin Contact Form Widget 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-32955 · Unknown · Contact Form Widget

Name of the Vulnerable Software and Affected Versions: Contact Form Widget versions 1.4.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Contact Form Widget, allowing unauthorized requests. Recommendations: For versions 1.4.2 and earlier, update to a version that...

CVE-2024-48042

Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through = 1.7.28...

CVE-2024-48042 WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Supsystic Contact Form by Supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through 1.7.28...

CVE-2024-48042

The CVE-2024-48042 issue affects WordPress Contact Form by Supsystic (plugin: Contact Form by Supsystic) up to version 1.7.28. Root cause: Improper neutralization of elements used in a template engine leading to Remote Code Execution (RCE). Impact per the sources: admin-level attacker could lever...

CVE-2024-48042 WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability

Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through = 1.7.28...

CVE-2024-9888

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget redirect URL in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2024-9891

The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7zlcustomhandledeactivationpluginformsubmission function in all versions up to, and including, 2.8.1. This makes it possible for...

CVE-2024-9891 Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7zlcustomhandledeactivationpluginformsubmission function in all versions up to, and including, 2.8.1. This makes it possible for...

PT-2024-32961

Name of the Vulnerable Software and Affected Versions Supsystic Contact Form versions 1.7.28 and earlier Description The issue is related to an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows Command Injection. This can lead to potential cyber...

WordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Awesome Contact Form7 for Elementor versions = 3.0...

WordPress Multiline files upload for contact form 7 plugin <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Multiline files upload for contact form 7 versions = 2.8.1...

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

The maintainers of the Jetpack WordPress plugin have released a security update to remediate a critical vulnerability that could allow logged-in users to access forms submitted by others on a site. Jetpack, owned by WordPress maker Automattic, is an all-in-one plugin that offers a comprehensive...

WordPress plugin Multiline files upload for contact form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...