CVE-2022-0141

The CVE details a CSRF vulnerability in the WordPress Visual Form Builder plugin, affecting versions prior to 3.0.8. The root cause is that nonce checks are not enforced, allowing an attacker who can lure a logged-in admin/editor to perform actions that delete and restore arbitrary form entries. ...

CVE-2022-0140

The CVE-2022-0140 issue affects WordPress Visual Form Builder plugin prior to 3.0.6 (also documented up to 3.0.8 in Nuclei templates). The vulnerability is an information-disclosure flaw caused by missing access control on the entry form export (vfb-export endpoint), allowing unauthenticated user...

CVE-2022-0140 Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint...

PT-2022-12990 · WordPress · Visual Form Builder

Name of the Vulnerable Software and Affected Versions: Visual Form Builder WordPress plugin versions prior to 3.0.6 Description: The issue allows unauthenticated users to see form entries or export them as a CSV file due to a lack of access control on entry form export. This can be done using the...

WordPress plugin Visual Form Builder 信息泄露漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. versions prior to WordPress Visual Form Builder...

WordPress plugin Visual Form Builder 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Visual Form Builder plugin versions prio...

WordPress plugin Visual Form Builder 访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Visual Form Builder plugin versions prior...

CVE-2022-0142: Improper Neutralization of Formula Elements in a CSV File

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2022-0141: Cross-Site Request Forgery (CSRF)

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks...

CVE-2022-0140: Missing Authentication for Critical Function

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint...

WordPress Visual Form Builder plugin <= 3.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Entries Deletion/Restoration

Cross-Site Request Forgery CSRF vulnerability leading to Entries Deletion/Restoration discovered by Vishnupriya Ilango in WordPress Visual Form Builder plugin versions = 3.0.7. Solution Update the WordPress Visual Form Builder plugin to the latest available version at least 3.0.8...

Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF

The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks Single entry trash: https://example.com/wp-admin/admin.php?page=vfb-entries&action=trash&entry=2 Since entry permanent deletion:...

Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Create/edit a form and put the following payload in the 'E-mail To' field: " The XSS will be...

WordPress Visual Form Builder plugin <= 3.0.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress Visual Form Builder plugin versions = 3.0.6. Solution Update the WordPress Visual Form Builder plugin to the latest available version at least 3.0.7...

Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create/edit a form and put the following payload in the 'E-mail To' field: " The XSS will ...

CVE-2021-24689

CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...

WordPress "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto" plugin < 5.3.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto" plugin versions 5.3.2. Solution Update the WordPress "WordPress form builder plugin for contact forms, surveys and...

CVE-2021-24689: Improper Limitation of a Pathname to a Restricted Directory

The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...

JqueryForm.com Jquery Form Builder 安全漏洞

JqueryForm.com Jquery Form Builder is a form builder from JqueryForm.com, Inc. A security vulnerability exists in Jquery Form Builder that stems from a generated form that allows a remote, authenticated attacker to bypass authentication and access the administrative portion of other forms hosted ...

JqueryForm.com Jquery Form Builder 跨站脚本漏洞

JqueryForm.com Jquery Form Builder is a form builder from JqueryForm.com, Inc. JqueryForm.com Jquery Form Builder suffers from a cross-site scripting vulnerability that stems from a Reflected Cross-Site Scripting XSS vulnerability in forms generated by JQueryForm.com prior to February 5, 2022 tha...