WordPress plugin PDF for WPForms + Drag and Drop Template Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

PT-2025-1490 · Unknown · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms versions through 2.3.28 Description: The issue is related to a Missing Authorization vulnerability in the Kali Forms Contact Form builder with drag & drop, allowing exploitation of incorrectly configured access control security...

PT-2025-1503 · Unknown · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms versions 2.3.27 and earlier Description: The issue is related to a Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop, which allows exploiting incorrectly configured access control security...

CVE-2024-10517 ProfilePress < 4.15.15 - Admin+ Stored XSS

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

CVE-2024-11436 Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

PT-2024-16991 · WordPress · The Drag & Drop Builder

Name of the Vulnerable Software and Affected Versions: The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress versions up to, and including, 1.4.19 Description: The issue is related to Reflected Cross-Site Scriptin...

WordPress Drag & Drop Builder plugin <= 1.4.19 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Drag & Drop Builder versions = 1.4.19...

PT-2024-16917 · WordPress · Hipaa Compliant Forms With Drag’N’Drop Hipaa Form Builder

Name of the Vulnerable Software and Affected Versions: HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder plugin for WordPress versions up to, and including, 1.3.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode due to insufficient...

CVE-2024-50427 WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through = 1.9.136...

CVE-2024-50427 WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through = 1.9.136...

WordPress SurveyJS: Drag & Drop WordPress Form Builder Plugin <= 1.9.136 is vulnerable to Arbitrary File Upload

Software SurveyJS: Drag & Drop WordPress Form Builder Type Plugin Vulnerable versions = 1.9.136 Fixed in 1.12.4 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50427 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 71e521e4a742 Credits...

CVE-2024-9975

A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclos...

CVE-2024-9975 SourceCodester Drag and Drop Image Upload upload.php unrestricted upload

A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclos...

SourceCodester Drag and Drop Image Upload 代码问题漏洞

SourceCodester Drag and Drop Image Upload is an open source drag and drop image upload program from SourceCodester. A code issue vulnerability exists in SourceCodester Drag and Drop Image Upload version 1.0, which stems from an unrestricted file upload issue contained in the /upload.php file...

CVE-2024-9417 Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are...

CVE-2024-9528

CVE-2024-9528 : Stored Cross-Site Scripting in the WordPress plugin “Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder” (versions ≤ 5.1.19). Root cause: insufficient input sanitization and output escaping in form label fields, allowing an authenticated attacker...

PT-2024-39618 · WordPress · The Hash Form – Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: The Hash Form – Drag & Drop Form Builder plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to a misconfigured file type validation in the handleUpload function, allowing unauthenticated attackers to...

CVE-2024-5857

CVE-2024-5857 affects Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free (WordPress). A missing capability check on the af2_handel_file_remove AJAX action in all versions up to 3.7.3.2 allows unauthenticated attackers to delete arbitrary media files. C...

CVE-2024-6703

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btntxt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output...

CVE-2024-6703

CVE-2024-6703 affects the WordPress plugin “Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder.” The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the description and btn_txt parameters, exploi...