Cross site scripting

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mfthankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level...

CVE-2023-0692

CVE-2023-0692 affects WordPress plugin Metform Elementor Contact Form Builder for WordPress (≤ 3.3.1). The issue is an information disclosure via the mf_payment_status shortcode, enabling authenticated users with subscriber-level capabilities or higher to view sensitive payment-status data of arb...

CVE-2023-0721

The Metform Elementor Contact Form Builder plugin for WordPress is affected by CVE-2023-0721 (affected versions up to and including 3.3.0). The underlying issue is CSV injection in exported CSV files, allowing unauthenticated input to be embedded in CSVs, which can lead to code execution when the...

CVE-2023-0708

The Metform Elementor Contact Form Builder for WordPress is affected by a Cross-Site Scripting vulnerability (CVE-2023-0708) in versions up to and including 3.3.0. The issue arises from the mf_first_name shortcode echoing unescaped form submissions, allowing an authenticated attacker with contrib...

CVE-2023-0708 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mffirstname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inje...

CVE-2023-0708

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mffirstname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inje...

CVE-2023-0710

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mfthankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level...

CVE-2023-0710

CVE-2023-0710 (Metform Elementor Contact Form Builder for WordPress) has a documented Cross-Site Scripting vulnerability in versions up to 3.3.0, exploitable by authenticated attackers with contributor-level permissions or higher. The issue involves echoing unescaped form submissions via the fnam...

CVE-2023-0691

CVE-2023-0691 affects the Metform Elementor Contact Form Builder plugin for WordPress. The vulnerability is an information disclosure via the mf_last_name shortcode, allowing authenticated attackers with subscriber-level capabilities or higher to access the submitter’s last name from arbitrary fo...

CVE-2023-0688 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form...

CVE-2023-0688

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form...

CVE-2023-0688

The CVE-2023-0688 case affects Metform Elementor Contact Form Builder for WordPress. Affected versions: up to and including 3.3.1. Root cause: Information disclosure via the mf_thankyou shortcode, enabling authenticated users with subscriber-level capabilities or higher to view sensitive form-sub...

CVE-2023-0709

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mflastname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to injec...

CVE-2023-0709

The CVE concerns the WordPress plugin Metform Elementor Contact Form Builder for WordPress. Versions up to and including 3.3.0 are vulnerable to stored Cross-Site Scripting via the mf_last_name shortcode, which echoes unescaped form submissions and can execute scripts in pages when a page contain...

CVE-2023-0694

CVE-2023-0694 affects Metform Elementor Contact Form Builder for WordPress. Affected versions are up to and including 3.3.1 and allow authenticated subscribers (or higher) to disclose sensitive data from standard form fields via the mf shortcode. The vulnerability is an Information Disclosure iss...

CVE-2023-0693

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mftransactionid' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the...

CVE-2023-0693

CVE-2023-0693 affects the Metform Elementor Contact Form Builder for WordPress. It causes information disclosure via the mf_transaction_id shortcode in versions up to 3.3.1, allowing authenticated users with subscriber-level privileges or higher to view transaction IDs for submissions that includ...

CVE-2023-0691: Authorization Bypass Through User-Controlled Key

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mflastname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary...

PT-2023-16461

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about transaction ids of...

PT-2023-16459

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about arbitrary form...