7 matches found
CVE-2023-1405
CVE-2023-1405 affects the Formidable Forms WordPress plugin up to version 6.1.2. It arises from unserializing user input, enabling unauthenticated PHP Object Injection when a suitable gadget is present. Impact is HIGH (I:HIGH, A:NONE) with remote attacker access. Mitigation: upgrade to version 6....
CVE-2023-2877
The Formidable Forms WordPress plugin versions prior to 6.3.1 is vulnerable to Remote Code Execution (RCE) due to insufficient validation of the plugin URL and inadequate user authorization during the add-on installation process. This allows a user with a role as low as Subscriber to install and ...
CVE-2024-23522
CVE-2024-23522 affects WordPress Formidable Forms plugin versions
CVE-2024-9768
Formidable Forms WordPress plugin prior to version 6.14.1 is affected: it does not sanitize/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Impact is a stored XSS vector within plugin settings; rem...
CVE-2024-11188
Formidable Forms – Contact Form Plugin for WordPress (CVE-2024-11188) is affected by a POST-based Reflected Cross-Site Scripting vulnerability via Custom HTML Form parameters in all versions up to 6.16.1.2, caused by insufficient input sanitization and output escaping. Attackers can exploit this ...
CVE-2022-45806
CVE-2022-45806 affects WordPress Formidable Forms plugin versions up to 5.5.4. The vulnerability is a Missing Authorization / Broken Access Control flaw in the Strategy11 Form Builder Team, allowing improper access due to incorrectly configured access control security levels. Public sources consi...