CVE-2023-35095

CVE-2023-35095 affects the WordPress plugin Flo Forms – Easy Drag & Drop Form Builder (Flothemes) up to version 1.0.40. The vulnerability is an authenticated (admin+) Stored Cross‑Site Scripting (XSS) flaw in Flo Forms, requiring admin privileges to exploit. The issue is grounded in the plugin’s ...

CVE-2021-4367

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via Options Change in versions up to and including 1.0.35 . The root cause is insufficient input sanitization , inadequate output escaping , and missing capability checks within t...