PT-2025-20090 · Unknown · Wp Gravity Forms Zendesk

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Zendesk versions 1.1.2 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which can be used for Phishing attacks. Recommendations: For WP...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the EntriesForm class in the Forms module. An attacker can submit files with malicious filenames and execute arbitrary JavaScript in the browser context of authenticated admins. Note: This is a persistent XS...

GHSA-2544-HPCQ-6G27 Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PT-2025-19774 · Unknown · Mezzanine Cms

Name of the Vulnerable Software and Affected Versions: Mezzanine CMS version 6.0.0 Description: A Cross-Site Scripting XSS issue exists in the "View Entries" feature within the Forms module. This allows for potential malicious script execution. Recommendations: For Mezzanine CMS version 6.0.0,...

CVE-2025-29573

Mezzanine CMS 6.0.0 exposes a Cross-Site Scripting (XSS) flaw in the Forms module’s View Entries feature. The vulnerability is tied to the EntriesForm path and can be triggered by submitting malicious filenames, enabling arbitrary JavaScript execution in an admin’s browser when affected entries a...

CVE-2024-13845

The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'processfeed' method of the GFWebhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13845

The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'processfeed' method of the GFWebhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13845

The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'processfeed' method of the GFWebhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13845 Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook

The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'processfeed' method of the GFWebhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13845 Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook

The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'processfeed' method of the GFWebhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13845

CVE-2024-13845 : Gravity Forms WebHooks (WordPress) is vulnerable to SSRF via GF_Webhooks::process_feed in all versions ≤ 1.6.0. Requires authenticated Admin+ access; can trigger requests to internal/internal-service locations. Remediation exists (patched in the records); upgrade to a fixed versi...

PT-2025-18357 · WordPress · Gravity Forms Webhooks

Name of the Vulnerable Software and Affected Versions: Gravity Forms WebHooks plugin for WordPress versions up to, and including, 1.6.0 Description: The issue allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations originating from the...

WordPress plugin Gravity Forms WebHooks 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...