WordPress Contact Form 7 Multi-Step Forms plugin <= 3.0.8 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Contact Form 7 Multi-Step Forms plugin versions = 3.0.8. Solution Update the WordPress Contact Form 7 Multi-Step Forms plugin to the latest available version at least 3.0.9...

Design/Logic Flaw

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll...

CVE-2019-9567

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll...

CVE-2019-9568

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

CVE-2019-9567

CVE-2019-9567 describes an XSS vulnerability in the WordPress Forminator Contact Form, Poll & Quiz Builder plugin prior to v1.6, caused by improper handling/encoding of a custom poll input field. Public records (NVD entry) state an XSS in the poll input field; some sources discuss persistent XSS ...

CVE-2019-9568

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

CVE-2019-9567: Improper Neutralization of Input During Web Page Generation

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll...

WordPress Contact Form Email 1.2.65 CSRF / Cross Site Scripting

Vulnerability: XSS & CSRF Affected Software: Contact Form Email Affected Version: 1.2.65 Patched Version: 1.2.66 CVE: not requested Risk: Medium Vendor Contacted: 10/31/2018 Vendor Fix: 10/31/2018 Public Disclosure: 02/05/2019 Credit: Tim Coen Reflected XSS CVSS 6.1 Medium...

Contact Form Email <= 1.2.65 - Multiple Cross-Site Scripting (XSS) & CSRF

The Contact Form Email WordPress plugin was affected by a Multiple Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=cpcontactformtoemail=1=1='"...

Contact Form Email <= 1.2.65 - Multiple Cross-Site Scripting (XSS) & CSRF

The Contact Form Email WordPress plugin was affected by a Multiple Cross-Site Scripting XSS & CSRF security vulnerability. http://www.example.com/wp-admin/admin.php?page=cpcontactformtoemail&edit=1&cal=1&item='"...

Ninja Forms < 3.3.21.2 - SQL Injection

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Contact Form by WPForms plugin <= 1.4.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Contact Form by WPForms plugin versions = 1.4.8. Solution Update the WordPress Contact Form by WPForms plugin to the latest available version at least 1.4.8.1...

WordPress Contact Form by WPForms plugin <= 1.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Contact Form by WPForms plugin versions = 1.4.7. Solution Update the WordPress Contact Form by WPForms plugin to the latest available versions at least 1.4.8...

CVE-2018-1002006

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes...

Privilege escalation

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes...

Cross site scripting

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable htmlid...

CVE-2018-1002006

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes...

CVE-2018-1002007

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable htmlid...

CVE-2018-1002006

The CVE-2018-1002006 entry concerns the WordPress Arigato Autoresponder and Newsletter plugin. Multiple vulnerabilities affect this plugin: authenticated blind SQL injection and multiple reflected M XSS issues, primarily in the integration-contact-form.html.php and related input handling. The Ope...