114 matches found
PT-2022-16360 · WordPress · Weforms
Name of the Vulnerable Software and Affected Versions: weForms WordPress plugin versions prior to 1.6.14 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...
WordPress plugin weForms 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2022-2395: Improper Neutralization of Input During Web Page Generation
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WordPress weForms plugin <= 1.6.13 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tri Wanda Septian in WordPress weForms plugin versions = 1.6.13. Solution Update the WordPress weForms plugin to the latest available version at least 1.6.14...
weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC On the dashboard navigate to weForms All Forms Add Form Choose Contact Form; Click Create Form...
weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. On the dashboard navigate to weForms All Forms Add Form Choose Contact Form; Click Create Form Settings...
WordPress weForms plugin <= 1.4.7 - CSV Injection vulnerability
CSV Injection vulnerability found by Mohamad Pishdar in WordPress weForms plugin versions = 1.4.7. Solution 2020-11-20 - we were unable to find information about the fix for this vulnerability...
weForms < 1.6.4 - CSV Injection
The plugin allows CSV injection via a form's entry...
CVE-2020-22276
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry...
CVE-2020-22276
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry...
Input validation
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry...
CVE-2020-22276
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry...
CVE-2020-22276
The CVE-2020-22276 affects the WeForms WordPress plugin, version 1.4.7, which is vulnerable to CSV injection via a form entry. The CVSS data in the record shows a high severity (CVSS v3.1 base score 9.8, CRITICAL) with network attack vector, no authentication, and no user interaction required, im...