CVE-2023-7203

The Smart Forms WordPress plugin, in versions prior to 2.6.87 , is vulnerable to broken access control and Cross-Site Request Forgery (CSRF) . The root cause is a lack of authorization for various AJAX actions and missing CSRF checks, which allows users with roles as low as subscriber to perform ...

CVE-2022-0163

CVE-2022-0163 concerns the WordPress plugin Smart Forms prior to 2.6.71, which exposes the rednao_smart_forms_entries_list AJAX endpoint without proper authorization. This allows any authenticated user (e.g., a subscriber) to download arbitrary form data, potentially exposing sensitive informatio...

CVE-2024-33593

CVE-2024-33593: Missing Authorization vulnerability in RedNao Smart Forms affecting Smart Forms up to version 2.6.91. Connected Red Hat entry confirms the issue description; no publicly documented exploitation details, impact specifics, or remediation in the provided documents. The known issue is...

CVE-2024-1905

The Smart Forms WordPress plugin versions before 2.6.96 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This remains pos...

CVE-2024-1307

The Smart Forms WordPress plugin versions prior to 2.6.94 are vulnerable to a broken access control issue (CWE-863 ). The root cause is a lack of proper authorization in certain actions, which allows users with a role as low as a subscriber to perform unauthorized actions, specifically involving ...

CVE-2023-49856

CVE-2023-49856 affects WordPress plugin Smart Forms (

CVE-2024-1306

The Smart Forms WordPress plugin, in versions before 2.6.94 , is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks proper CSRF checks in certain areas. This flaw could allow an attacker to trick a logged-in user into performing unintended actions, such as editing entries . The risk...

CVE-2019-5924

The CVE-2019-5924 issue affects the WordPress Smart Forms plugin (versions 2.6.15 and earlier). The root cause is a Cross-Site Request Forgery (CSRF) vulnerability that can allow an attacker to hijack an administrator’s authenticated session via a malicious page, enabling unauthorized actions suc...