CVE-2019-15114

CVE-2019-15114 affects the WordPress FormCraft Form Builder plugin. The vulnerability is a CSRF flaw in versions before 1.2.2, arising from insufficient request verification, potentially allowing unauthorized actions on behalf of a user. Mitigation: upgrade to 1.2.2 or later (as indicated by mult...

CVE-2024-13783

CVE-2024-13783 affects the FormCraft WordPress plugin (all versions up to 3.9.11). The issue is a missing capability check in formcraft-main.php that allows authenticated users with Subscriber-level access and above to export all plugin data from form submissions. This is an unauthorized data acc...

CVE-2025-0817

CVE-2025-0817 affects the WordPress plugin FormCraft (WordPress) and is a Stored Cross-Site Scripting vulnerability via SVG file uploads. Root cause: insufficient input sanitization and output escaping for SVG uploads in all versions up to 3.9.11. Impact: unauthenticated attackers can inject web ...

CVE-2022-1647

CVE-2022-1647 affects the WordPress FormCraft Basic plugin (versions before 1.2.6). The root cause is failure to sanitize/escape Field Labels, enabling stored XSS by high-privilege users (e.g., admins) when saving labels. Exploitation results in JavaScript execution in pages/posts that embed the ...

CVE-2023-2592

CVE-2023-2592 affects FormCraft Premium for WordPress, prior to version 3.9.7. Root cause: improper sanitization/escaping of a parameter before using it in an SQL statement. Impact: SQL injection that is exploitable by high-privilege users (e.g., admin). Mitigation: update to 3.9.7 or later (vuln...

CVE-2017-18600

The CVE-2017-18600 entry describes a stored XSS vulnerability in the FormCraft3 WordPress plugin prior to version 3.4, specifically via the New Form > Heading > Heading Text field. The root cause is insufficient validation/ sanitization of client-side data, allowing injected script to run w...

CVE-2013-7187

CVE-2013-7187 is a SQL injection vulnerability in the WordPress FormCraft plugin (form.php) affecting version 1.3.7 and earlier. The vulnerability arises from unsafely handling the id parameter, allowing remote attackers to execute arbitrary SQL commands. The issue is documented across multiple s...

CVE-2019-5920

The CVE refers to the WordPress FormCraft plugin, version

CVE-2023-22717

CVE-2023-22717 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin FormCraft (nCrafts FormCraft) , affecting versions up to and including 1.2.6 . The vulnerability requires at least a Contributor+ authentication level and can be triggered through stored input, leading to ...