CVE-2024-7414: Exposure of Sensitive Information to an Unauthorized Actor

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-29820

CVE-2024-29820 is a stored XSS in RedNao PDF Builder for WPForms caused by improper neutralization of input during web page generation. Affected product: PDF Builder for WPForms, versions: n/a through 1.2.88. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (base 6.5, MEDIUM). Connected sourc...

CVE-2024-29820: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88...