WordPress CP Contact Form with Paypal plugin <= 1.2.97 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress CP Contact Form with Paypal plugin versions = 1.2.97. Solution Update the WordPress CP Contact Form with Paypal plugin to the latest available version at least 1.2.98...

CVE-2019-12134

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...

CVE-2019-12134

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...

CVE-2019-12134: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection exists in the export feature in Workday through 32 via a value provided by a low-privileged user in a contact form field that is mishandled in a CSV export...

CVE-2019-7411

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

Cross site scripting

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

CVE-2019-7411

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

PT-2019-18587

Name of the Vulnerable Software and Affected Versions MyThemeShop Launcher plugin version 1.0.8 Description The issue concerns multiple stored cross-site scripting XSS instances. Remote authenticated users can inject arbitrary web script or HTML via various fields, including: - Title - Favicon -...

WordPress Contact Form Maker Plugin < 1.13.5 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Directory traversal

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...

CVE-2019-11591

The CVE-2019-11591 issue affects the WebDorado Contact Form plugin for WordPress (pre-1.13.5). The vulnerability arises from a CSRF flaw in wp-admin/admin-ajax.php where a mismatch between POST action and unsanitized GET action allows local file inclusion via directory traversal. Impact is descri...

CVE-2019-11591

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...

WordPress Contact Form Builder Plugin < 1.0.69 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

PT-2019-12401 · Webdorado · Webdorado Contact Form

Name of the Vulnerable Software and Affected Versions: WebDorado Contact Form plugin versions prior to 1.13.5 Description: The issue allows for CSRF via the "wp-admin/admin-ajax.php" API endpoint, specifically through the action parameter, which can lead to local file inclusion via directory...

CVE-2019-11591: Improper Limitation of a Pathname to a Restricted Directory

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...

CVE-2019-11557

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...

CVE-2019-11557

The CVE-2019-11557 entry concerns the WordPress plugin WebDorado Contact Form Builder, versions prior to 1.0.69. The vulnerability is a CSRF flaw on wp-admin/admin-ajax.php where discrepancies between POST[action] and GET[action] (unsanitized GET value) enable local file inclusion via directory t...

PT-2019-12378 · Webdorado · Webdorado Contact Form Builder

Name of the Vulnerable Software and Affected Versions: WebDorado Contact Form Builder plugin versions prior to 1.0.69 Description: The issue allows for CSRF via the "wp-admin/admin-ajax.php" API endpoint, specifically through the action parameter, which can lead to local file inclusion via...

CVE-2019-11557: Improper Limitation of a Pathname to a Restricted Directory

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...

WordPress Contact Form Builder plugin <= 1.0.68 - Cross-Site Request Forgery (CSRF) leading to Local File Inclusion (LFI) vulnerability

Cross-Site Request Forgery CSRF leading to Local File Inclusion LFI vulnerability found by Panagiotis Vagenas in WordPress Contact Form Builder plugin versions = 1.0.68. Solution Update the WordPress Contact Form Builder plugin to the latest available version at least 1.0.69...