CVE-2024-7414: Exposure of Sensitive Information to an Unauthorized Actor

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-29820

CVE-2024-29820 is a stored XSS in RedNao PDF Builder for WPForms caused by improper neutralization of input during web page generation. Affected product: PDF Builder for WPForms, versions: n/a through 1.2.88. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (base 6.5, MEDIUM). Connected sourc...

PT-2024-23067

Name of the Vulnerable Software and Affected Versions RedNao PDF Builder for WPForms versions 1.2.88 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacke...

CVE-2024-29820: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88...