PT-2023-16462

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about any standard form...

PT-2023-16456

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about form submissions,...

PT-2023-16459

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about arbitrary form...

Metform Elementor Contact Form Builder < 3.3.2 - Multiple Subscriber+ Sensitive Information Disclosure Issues

The plugin does not prevent less privileged users, like subscribers, from accessing various sensitive information via the plugin's shortcodes. This includes payment statuses, transaction IDs, submitter's name information, and virtually all fields of any form submissions...

Metform Elementor Contact Form Builder < Unauthenticated CSV Injection

The plugin does not properly escape user-supplied input which is output in CSV files, which could be abused in CSV Injection attacks...

Metform Elementor Contact Form Builder < 3.3.1 - Multiple Contributor+ Stored XSS via Shortcode

The plugin does not properly sanitize and escape user input when processed by many of its shortcodes, which could enable users with contributor privileges to conduct Stored Cross-Site Scripting attacks on the site. Affected shortcodes include mf, mffirstname, mflastname, and mfthankyou...

CVE-2021-4367: Improper Neutralization of Input During Web Page Generation

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the floimportformsoptions AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing...

WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder by vcita Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2301 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 8de38a056831 Credits Jonas...

WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder by vcita Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2300 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3b4b71b799e4 Credits Jonas...

CVE-2023-2301

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. This is due to missing nonce validation on the lsparsevcitacallback function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2023-2301

CVE-2023-2301 affects the WordPress plugin Contact Form Builder by vcita (versions up to 4.9.1). The issue is a Cross-Site Request Forgery caused by missing nonce validation on the ls_parse_vcita_callback function, allowing unauthenticated attackers to modify plugin settings and inject malicious ...

CVE-2023-2300 Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the editposts...

CVE-2023-2300

CVE-2023-2300 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Contact Form Builder by vcita (≤ 4.9.1). The issue arises from insufficient input sanitization and output escaping of the email parameter, allowing an authenticated attacker with edit_posts capabilit...

CVE-2023-2300 Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the editposts...

WordPress plugin Contact Form Builder by vcita 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Contact Form Builder by vcita 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-18816 · Vcita · Contact Form Builder By Vcita

Name of the Vulnerable Software and Affected Versions: Contact Form Builder by vcita plugin for WordPress versions up to, and including, 4.9.1 Description: The issue is due to missing nonce validation on the ls parse vcita callback function, making it possible for unauthenticated attackers to...

CVE-2023-2301: Cross-Site Request Forgery (CSRF)

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the lsparsevcitacallback function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2023-2300: Improper Neutralization of Input During Web Page Generation

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the editposts...

Contact Form Builder by vcita <= 4.10.2 - Settings Update Via CSRF

The plugin does not protect its settings page against CSRF attacks, allowing an unauthenticated attacker to change the plugin's settings, and on older versions alert1;...