CVE-2024-2043

The CVE CVE-2024-2043 concerns the EleForms – All In One Form Integration including DB for Elementor WordPress plugin. A missing capability check when downloading form submissions allows unauthenticated users to view submissions in all versions up to and including 2.9.9.7. Root cause: absent auth...

CVE-2024-2082

CVE-2024-2082 : EleForms – All In One Form Integration including DB for Elementor (WordPress) suffers stored XSS in multiple parameters due to insufficient input sanitization/output escaping in all versions up to 2.9.9.7. Attackers can exploit without authentication to inject scripts executed on ...

CVE-2024-6628

CVE-2024-6628 : EleForms – All In One Form Integration including DB for Elementor (WordPress) is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 2.9.9.9 due to missing/incorrect nonce validation when deleting form submissions. This enables unauthenticated attackers to cause ...

CVE-2024-6626

CVE-2024-6626 concerns the WordPress plugin EleForms – All In One Form Integration including DB for Elementor . The issue arises from a missing capability check in several functions across all versions up to 2.9.9.9, enabling unauthenticated attackers to view form submissions. According to the co...

CVE-2024-38748

CVE-2024-38748 is a broken access control vulnerability in TheInnovs EleForms (WordPress plugin) affecting EleForms versions from n/a up to 2.9.9.9. The NVD entry lists this as an Access Control vulnerability with a CVSS v3.1 base score of 9.8 (CRITICAL). Other connected sources reiterate the aff...