CVE-2023-0710

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mfthankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level...

CVE-2023-0688 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form...

CVE-2023-0688

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form...

CVE-2023-0688

The CVE-2023-0688 case affects Metform Elementor Contact Form Builder for WordPress. Affected versions: up to and including 3.3.1. Root cause: Information disclosure via the mf_thankyou shortcode, enabling authenticated users with subscriber-level capabilities or higher to view sensitive form-sub...

CVE-2023-0709

The CVE concerns the WordPress plugin Metform Elementor Contact Form Builder for WordPress. Versions up to and including 3.3.0 are vulnerable to stored Cross-Site Scripting via the mf_last_name shortcode, which echoes unescaped form submissions and can execute scripts in pages when a page contain...

CVE-2023-0709

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mflastname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to injec...

CVE-2023-0693

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mftransactionid' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the...

CVE-2023-0693

CVE-2023-0693 affects the Metform Elementor Contact Form Builder for WordPress. It causes information disclosure via the mf_transaction_id shortcode in versions up to 3.3.1, allowing authenticated users with subscriber-level privileges or higher to view transaction IDs for submissions that includ...

CVE-2023-0694

CVE-2023-0694 affects Metform Elementor Contact Form Builder for WordPress. Affected versions are up to and including 3.3.1 and allow authenticated subscribers (or higher) to disclose sensitive data from standard form fields via the mf shortcode. The vulnerability is an Information Disclosure iss...

WordPress Plugin Metform Elementor Contact Form Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2023-16461

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about transaction ids of...

CVE-2023-0708: Improper Neutralization of Input During Web Page Generation

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mffirstname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inje...

CVE-2023-0710: Improper Neutralization of Input During Web Page Generation

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mfthankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level...

PT-2023-16462

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about any standard form...

PT-2023-16456

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about form submissions,...

PT-2023-16459

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.1 Description The issue allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about arbitrary form...

CVE-2023-0695: Improper Neutralization of Input During Web Page Generation

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject...

CVE-2023-0688: Authorization Bypass Through User-Controlled Key

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form...

CVE-2023-1843: Missing Authorization

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalinksetup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the...

CVE-2023-0709: Improper Neutralization of Input During Web Page Generation

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mflastname' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to injec...