CVE-2023-50846

Mode C: CVE-2023-50846 affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (WordPress). The issue is an SQL Injection in RegistrationMagic up to version 5.2.4.5 caused by improper neutralization of user-controlled input. Impact is significant (high), ...

CVE-2023-50836

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28...

CVE-2023-50836

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28...

CVE-2023-50836 WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28...

CVE-2023-50836

CVE-2023-50836 affects WordPress HTML Forms Plugin versions up to 1.3.28 (and ≤1.3.29 per PatchStack) with a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue is tied to the ibericode HTML Forms integration in the plugin,...

CVE-2023-50836 WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28...

PT-2023-31667 · Unknown · Ibericode Html Forms

Name of the Vulnerable Software and Affected Versions: ibericode HTML Forms versions 1.3.28 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2023-31916 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue affects users with access to backend forms that include a ColorPicker FormWidget, allowing them to provide a value that would then be rendered unescaped in the backend form, potentiall...

WordPress Plugin HTML Forms Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Plugin NEX-Forms SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.2 Fixed in 8.5.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52120 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6c987b0249e3 Credits...

PT-2023-31669 · Unknown · Basix Nex-Forms

Name of the Vulnerable Software and Affected Versions: Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more versions through 8.5.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...

PT-2023-31917 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue concerns a Local File Inclusion vulnerability in Winter CMS, a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can...

WordPress Piotnet Forms Plugin <= 1.0.29 is vulnerable to Broken Access Control

Software Piotnet Forms Type Plugin Vulnerable versions = 1.0.29 Fixed in 1.0.30 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51413 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 662da8d8f3b6 Credits Abdi Pranata Required...

WordPress Piotnet Forms Plugin <= 1.0.28 is vulnerable to Arbitrary File Upload

Software Piotnet Forms Type Plugin Vulnerable versions = 1.0.28 Fixed in 1.0.29 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51412 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 72be89d5a22e Credits Rafie Muhammad Patchstack Required...

WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Everest Forms Type Plugin Vulnerable versions = 2.0.4.1 Fixed in 2.0.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51695 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d679b5b20d8a Credits Robert DeVore Required privilege...

WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e48c62e620dc Credits Huynh Tien Si Required privilege...

CVE-2023-5980

The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...