18 matches found
CVE-2026-9815
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server...
CVE-2026-9815 MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server...
CVE-2026-9815
The MagicForm WordPress plugin (versions
PT-2026-50647
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server...
EUVD-2022-50352
Malicious code in bioql PyPI...
EUVD-2025-1936
Malicious code in bioql PyPI...
CVE-2025-0939
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...
CVE-2022-47592
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2025-0939
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...
CVE-2025-0939
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...
CVE-2025-0939 MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...
WordPress plugin MagicForm 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2025-4104
Name of the Vulnerable Software and Affected Versions MagicForm plugin for WordPress versions up to, and including, 1.6.2 Description The issue arises from a missing capability check on the plugin's AJAX actions, allowing authenticated attackers with Subscriber-level access and above to invoke...
CVE-2022-47592
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592 WordPress MagicForm Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592
CVE-2022-47592 is a reflected XSS in the WordPress MagicForm plugin <= 0.1 (Dmytriy.Cooperman). The vulnerability arises from insufficient sanitization/escaping of input, allowing an attacker to inject scripts via a reflected parameter. Exploitation is unauthenticated and network-based; the CV...
WordPress plugin MagicForm 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...