CVE-2017-18491

The CVE-2017-18491 entry corresponds to the WordPress plugin “Contact Form by BestWebSoft” up to version 4.0.6, which has multiple XSS flaws. The Nuclei template and related sources confirm the vulnerability affects this plugin and describe the impact: authenticated attackers can inject and execu...

CVE-2015-9295

The WordPress plugin contact-form-plugin is affected by an XSS vulnerability in versions before 3.96. The issue is described across multiple sources (including Red Hat and CVE records) as a client-side script execution vulnerability in the plugin, with no public exploit details provided in the do...

CVE-2015-9295

The contact-form-plugin plugin before 3.96 for WordPress has XSS...

CVE-2013-7475

CVE-2013-7475 : The WordPress plugin contact-form-plugin is vulnerable to cross-site scripting in all versions before 3.52. The vulnerability is due to an XSS flaw in the plugin and affects the WordPress integration; exploitation details or in-the-wild status are not provided in the documents. No...

PT-2019-8426

Name of the Vulnerable Software and Affected Versions contact-form-plugin versions prior to 4.0.6 Description The issue is related to multiple XSS problems. Recommendations For versions prior to 4.0.6, update to version 4.0.6 or later to resolve the issue...

PT-2019-7665

Name of the Vulnerable Software and Affected Versions contact-form-plugin versions prior to 4.0.2 Description The issue affects the contact-form-plugin plugin for WordPress, allowing for cross-site scripting XSS attacks. Recommendations For versions prior to 4.0.2, update to version 4.0.2 or late...

PT-2019-7024

Name of the Vulnerable Software and Affected Versions contact-form-plugin plugin versions prior to 3.52 for WordPress Description The issue is related to a cross-site scripting XSS problem. There is no information provided about the estimated number of potentially affected devices worldwide or...

CVE-2016-10869: Improper Neutralization of Input During Web Page Generation

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS...

CVE-2015-9295: Improper Neutralization of Input During Web Page Generation

The contact-form-plugin plugin before 3.96 for WordPress has XSS...

CVE-2013-7475: Improper Neutralization of Input During Web Page Generation

The contact-form-plugin plugin before 3.52 for WordPress has XSS...

CVE-2017-18491: Improper Neutralization of Input During Web Page Generation

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues...

PT-2019-7254

Name of the Vulnerable Software and Affected Versions contact-form-plugin plugin versions prior to 3.96 for WordPress Description The issue is related to a cross-site scripting XSS problem. There is no information provided about the estimated number of potentially affected devices worldwide or...

CVE-2018-14430

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

WordPress Trust Form 2.0 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Trust Form WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

Wordpress tidio-form plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL servers to set up a personal blog site. tidio-form is one of the online live chat form plug-ins. A cross-site scripting vulnerability exists in versi...

WordPress Booking Calendar Contact Form Plugin SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress Booking Calendar Contact Form plugin suffers from a SQL injection vulnerability by adding specially crafted shortco...

WordPress Calculated Fields Form Plugin SQL Injection

An SQL injection vulnerability exists in the WordPress Calculated Fields Form Plugin. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data...

WordPress N-Media Website Contact Form Plugin File Upload Vulnerability

WordPress N-Media Website Contact Form Plugin is prone to arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-4518

Cross-site scripting XSS vulnerability in xdresize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter...

PT-2012-6261

Name of the Vulnerable Software and Affected Versions Video Lead Form plugin for WordPress affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a "video-lead-form" action t...