PT-2024-37363 · WordPress · Registration Forms

Name of the Vulnerable Software and Affected Versions: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress versions up to, and including, 3.8.3.4 Description: The issue allows authenticated...

PT-2024-37534

Name of the Vulnerable Software and Affected Versions: Gutenberg Forms plugin for WordPress versions up to, and including, 2.2.9 Description: The issue allows arbitrary file uploads due to the ability of users to specify allowed file types in the upload function. This enables unauthenticated...

CVE-2024-6313: Unrestricted Upload of File with Dangerous Type

The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-37934: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4...

WordPress plugin Gutenberg Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.9 is vulnerable to Arbitrary File Upload

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6313 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6945098cfe6d Credits István Márt...

CVE-2024-36676

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms...

WordPress plugin Registration Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Ninja Forms code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin NEX-Forms versions = 8.5.10...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.10 is vulnerable to Cross Site Scripting (XSS)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.10 Fixed in 8.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37512 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6818a3b8cb82 Credits LVT-tholv2k Require...

WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Charitable versions = 1.8.1.7...

WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Ninja Forms versions = 3.8.4...

WordPress Ninja Forms Plugin <= 3.8.4 is vulnerable to Broken Access Control

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.4 Fixed in 3.8.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37934 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5bd0529a71e3 Credits Rafie Muhammad Patchstack Require...

WordPress WPQA plugin < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability

Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress WPQA plugin < 6.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress Tooltip for Gravity Forms plugin <= 2.9 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Tooltip for Gravity Forms versions = 2.9...

WordPress Integration for Luminate and Gravity Forms plugin <= 1.3.3 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Integration for Luminate and Gravity Forms versions = 1.3.3...

WordPress Magic Conversation For Gravity Forms plugin <= 3.0.96 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Magic Conversation For Gravity Forms versions = 3.0.96...

WordPress Tooltip for Gravity Forms Plugin <= 2.9 is vulnerable to Backdoor

Software Tooltip for Gravity Forms Type Plugin Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 852a3f555d15 Credits Sansec.io Required privilege Unauthenticated Published 3...