WordPress Multiline files upload for contact form 7 Plugin <= 2.8.1 is vulnerable to Broken Access Control

Software Multiline files upload for contact form 7 Type Plugin Vulnerable versions = 2.8.1 Fixed in 2.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9891 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID c40586cc4d31 Credits...

WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by UKO Patchstack Alliance in WordPress Plugin Contact Form by Supsystic versions = 1.7.28...

WordPress Contact Form by Supsystic Plugin <= 1.7.28 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form by Supsystic Type Plugin Vulnerable versions = 1.7.28 Fixed in 1.7.29 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-48046 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cce1073296d4 Credits UKO Required privile...

WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin Contact Form by Supsystic versions = 1.7.28...

WordPress Contact Form by Supsystic Plugin <= 1.7.28 is vulnerable to Remote Code Execution (RCE)

Software Contact Form by Supsystic Type Plugin Vulnerable versions = 1.7.28 Fixed in 1.7.29 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-48042 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 062050e33e8e Credits Hakiduck Required privile...

CVE-2024-47331

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NinjaTeam Multi Step for Contact Form allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through 2.7.7...

CVE-2024-47331

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through = 2.7.7...

CVE-2024-47331 WordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through = 2.7.7...

CVE-2024-47331 WordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NinjaTeam Multi Step for Contact Form allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through 2.7.7...

CVE-2024-47331

CVE-2024-47331 — Unauthenticated SQL Injection in WordPress plugin “Multi Step for Contact Form” (NinjaTeam) affecting versions

CVE-2024-9507

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This...

CVE-2024-9507 Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This...

CVE-2024-9507 Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This...

CVE-2024-9507

CVE-2024-9507 concerns the WordPress plugin Bit Form (Contact Form by Bit Form) up to version 2.15.2. The issue arises from improper input validation in the iconUpload function, enabling authenticated attackers with Administrator-level access and above to perform a PHP filter chain attack and rea...

PT-2024-32545 · Ninja Team · Ninjateam Multi Step For Contact Form

Name of the Vulnerable Software and Affected Versions: NinjaTeam Multi Step for Contact Form versions n/a through 2.7.7 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.15.2 is vulnerable to Arbitrary File Download

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.15.2 Fixed in 2.15.3 OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-9507 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 2674338e71f9 Credits TANG Cheuk Hei siunam...

WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability

CSRF vulnerability discovered by Abdi Pranata in WordPress Plugin Contact Form Widget versions = 1.4.2...

WordPress Contact Form Widget Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contact Form Widget Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-48037 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5cb5ac9f9e50 Credits Abdi Pranata...

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.3...

WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 – PayPal & Stripe Add-on Type Plugin Vulnerable versions = 2.3 Fixed in 2.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48021 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e2541d5dd28 Credits Le Ngoc An...