CVE-2022-23179

CVE-2022-23179 concerns the WordPress plugin “Contact Form & Lead Form Elementor Builder” (versions before 1.7.0). The issue is that multiple form fields are not escaped before output in HTML attributes, enabling stored or reflected Cross-site Scripting when a high-privilege user interacts with t...

CVE-2024-3637

CVE-2024-3637 affects the WordPress plugin Lead Form Builder (Responsive Contact Form Builder & Lead Generation) = 1.9.8. If upgrading to a version addressing this issue (e.g., 1.9.8 or later) is available, apply it. Until patched, exposure exists for admin users who can modify settings. Technica...

CVE-2022-23180

Summary of CVE-2022-23180 (WordPress plugin: Contact Form & Lead Form Elementor Builder) Affected product: WordPress plugin Contact Form & Lead Form Elementor Builder, versions prior to 1.7.4.Root cause: Missing authorization and nonce checks in the plugin, allowing bypass by authenticated users....

CVE-2021-24967

CVE-2021-24967 affects the WordPress plugin “Contact Form & Lead Form Elementor Builder” up to version 1.6.3 (pre-1.6.4). The issue is a failure to sanitize/escape certain lead values, enabling unauthenticated users to trigger stored cross-site scripting against logged-in admins viewing the leads...

CVE-2024-10475

The CVE-2024-10475 entry concerns the WordPress plugin Lead Form Builder / Responsive Contact Form Builder & Lead Generation Plugin, affected in versions prior to 1.9.8. The root cause is inadequate sanitisation/escaping of certain plugin settings, enabling Stored Cross-Site Scripting by high-pri...