CVE-2022-1046: Improper Neutralization of Input During Web Page Generation

The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0140 Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint...

PT-2022-12991

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.0.8 Description The issue allows attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks due to the lack of nonce checks. Recommendations...

PT-2022-12992

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.0.8 Description The issue allows a user with low-level or no privileges to inject a command into the exported CSV file, potentially leading to code execution. This is achieved through CS...