CVE-2021-24967

CVE-2021-24967 affects the WordPress plugin “Contact Form & Lead Form Elementor Builder” up to version 1.6.3 (pre-1.6.4). The issue is a failure to sanitize/escape certain lead values, enabling unauthenticated users to trigger stored cross-site scripting against logged-in admins viewing the leads...

CVE-2021-24967 Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads...

Contact Form & Lead Form Elementor Builder < 1.6.8 - Subscriber+ Arbitrary Lead Deletion

The plugin does not have capability and CSRF checks in the deleteleadsbackend AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber could delete arbitrary Leads. Attackers could also make any logged in users delete leads via a CSRF attack POST...

WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.6.7 - Arbitrary Lead Deletion vulnerability

Arbitrary Lead Deletion vulnerability discovered by WPScanTeam in WordPress Contact Form & Lead Form Elementor Builder plugin versions = 1.6.7. Solution Update the WordPress Contact Form & Lead Form Elementor Builder plugin to the latest available version at least 1.6.8...

WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Contact Form & Lead Form Elementor Builder plugin versions = 1.6.3. Solution Update the WordPress Contact Form & Lead Form Elementor Builder plugin to the latest available version at least 1.6...

Video Lead Form - "errMsg" Cross-Site Scripting

The Video Lead Form WordPress plugin was affected by a "errMsg" Cross-Site Scripting security vulnerability...

CVE-2012-6312

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

Update on CVE assigned for Video Lead Form Plugin Cross-Site

Exploit Title : Video Lead Form Plugin Cross-Site Scripting Vulnerabilities which affects Wordpress URL Author: Aditya Balapure home: http://adityabalapure.blogspot.in/ Date: 24/11/12 version: 0.5 software link: http://wordpress.org/extend/plugins/video-lead-form/ CVE Assigned - CVE-2012-6312...

Video Lead Form Plugin Cross-Site Scripting Vulnerabilities which affects Wordpress URL

Exploit Title : Video Lead Form Plugin Cross-Site Scripting Vulnerabilities which affects Wordpress URL Author: Aditya Balapure home: http://adityabalapure.blogspot.in/ Date: 24/11/12 version: 0.5 software link: http://wordpress.org/extend/plugins/video-lead-form/ Video Lead Form plugin descripti...

WordPress Video Lead Form 0.5 Cross Site Scripting

Exploit Title : Video Lead Form Plugin Cross-Site Scripting Vulnerabilities which affects Wordpress URL Author: Aditya Balapure home: http://adityabalapure.blogspot.in/ Date: 24/11/12 version: 0.5 software link: http://wordpress.org/extend/plugins/video-lead-form/ Video Lead Form plugin descripti...

WordPress Video Lead Form Plugin - Cross Site Scripting

WordPress Video Lead Form plugin's "errMsg" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can stea...

WordPress Plugin Video Lead Form - 'errMsg' Cross-Site Scripting

source: https://www.securityfocus.com/bid/56737/info The Video Lead Form plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...