Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,932 results · page 26 of 59
Jan 22, 2025dForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue affects dForms: from n/a through <= 1.0.
- Product
- dForms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update dForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.CVE-2024-54795 · Other software · ENG · reported by MITREMedium 5.4
SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.
- Product
- Spagobi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-sm allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through <= 4.1.
- Product
- MailChimp Subscribe Forms
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site pCVE-2025-23086 · Other software · Brave · reported by support@hackerone.comMedium 6.1
On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.
- Product
- Desktop Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resouCVE-2024-41743 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources.
- Product
- TXSeries for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations.CVE-2024-41742 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.
- Product
- TXSeries for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Gravity Forms: Stored Cross-Site ScriptingCVE-2024-13378 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is only successful in the Chrome web browser, and requires directly browsing the media file via the attachment post.
- Product
- Gravity Forms
- Affected
- up to 2.9.1.3
- What to do
- Affects up to 2.9.1.3. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.comwordfence.com
Jan 17, 2025Gravity Forms: Stored Cross-Site ScriptingCVE-2024-13377 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Gravity Forms
- Affected
- up to 2.9.1.3
- What to do
- Affects up to 2.9.1.3. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.comwordfence.com
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function.CVE-2024-57583 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.CVE-2024-57582 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.CVE-2024-57581 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.CVE-2024-57580 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function.CVE-2024-57579 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function.CVE-2024-57578 · Network & remote access · Tenda · reported by MITREHigh 8.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.CVE-2024-57577 · Network & remote access · Tenda · reported by MITREMedium 5.7
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.CVE-2025-22913 · Other software · Edimax · reported by MITRECritical 9.8
RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.
- Product
- Re11s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025GSheetConnector for Forminator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.
- Product
- GSheetConnector for Forminator Forms
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update GSheetConnector for Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025PDF for WPForms + Drag and Drop Template Builder: Stored Cross-Site ScriptingCVE-2024-12593 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PDF for WPForms + Drag and Drop Template Builder
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update PDF for WPForms + Drag and Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 14, 2025Umbraco.Forms is a web form framework written for the nuget ecosystem.CVE-2025-23041 · Other software · umbraco · reported by GitHubMedium 5.8
Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- Umbraco.Forms.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows HTML Platforms Security Feature Bypass VulnerabilityCVE-2025-21269 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Windows HTML Platforms Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025GatorMail SmartForms: Stored Cross-Site ScriptingCVE-2024-11386 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GatorMail SmartForms
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update GatorMail SmartForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 10, 2025On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted paCVE-2024-7095 · Other software · Arista Networks · reported by psirt@arista.comMedium 4.3
On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behCVE-2024-5872 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.5
On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP FloCVE-2024-6437 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.8
On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
- Product
- EOS-Policy Based Routing (PBR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Conversational Forms for ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <= 1.4.2.
- Product
- Conversational Forms for ChatBot
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 20254ECPS Web Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-22504 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.
- Product
- 4ECPS Web Forms
- Affected
- up to 0.2.18
- What to do
- Affects up to 0.2.18. Update 4ECPS Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
- Product
- WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
- Affected
- up to 8.0.6
- What to do
- Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SureForms – Drag and Drop Form Builder for: Information ExposureCVE-2024-12713 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
- Product
- SureForms – Drag and Drop Form Builder for
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2024-12738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 3.12.9
- What to do
- Affects up to 3.12.9. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for CVE-2024-11826 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025BSK Forms Blacklist: Cross-Site Request Forgery (CSRF)CVE-2025-22347 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.
- Product
- BSK Forms Blacklist
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
- Product
- Contact Form by WPForms
- Affected
- up to 1.9.2.2
- What to do
- Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
- Product
- CubeWP Forms
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Flo Forms: Missing AuthorizationCVE-2023-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.
- Product
- Flo Forms
- Affected
- up to 1.0.41
- What to do
- Affects up to 1.0.41. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Quill Forms: Missing AuthorizationCVE-2023-46610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <= 3.3.0.
- Product
- Quill Forms
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Quill Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-46083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.27.
- Product
- Kali Forms
- Affected
- up to 2.3.27
- What to do
- Affects up to 2.3.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-45275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.
- Product
- Kali Forms
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Reflected XSS.This issue affects HTML Forms: from n/a through <= 1.4.1.
- Product
- HTML Forms
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form, Survey & Form Builder – MightyForms: Missing AuthorizationCVE-2024-56002 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through <= 1.3.9.
- Product
- Contact Form, Survey & Form Builder – MightyForms
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2024The Ninja Forms – The Contact Form Builder That Grows With You: Arbitrary shortcode executionCVE-2024-12238 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.8.22
- What to do
- Affects up to 3.8.22. Update The Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 26, 2024Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.CVE-2024-45600 · Other software · pluginsGLPI · reported by GitHubHigh 7.7
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.
- Product
- fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-11223 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPForms
- Fixed in
- 1.9.2.3
- What to do
- Update WPForms to 1.9.2.3 or newer.
Dec 25, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: SQL InjectionCVE-2024-10862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_params' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited via CSRF due to a lack of nonce validation on the get_table_records AJAX action.
- Product
- NEX-Forms – Ultimate Form Builder – Contact forms and much more
- Affected
- up to 8.7.15
- What to do
- Affects up to 8.7.15. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2024Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arCVE-2024-12014 · Other software · Lleidanet PKI · reported by cve-coordination@incibe.esLow 2
Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
- Product
- eSigna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024Flaming Forms: Cross-Site Request Forgery (CSRF)CVE-2024-54398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-10646 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024MailChimp Forms by MailMunch: Missing AuthorizationCVE-2023-40203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Contact Forms by Cimatti: Missing AuthorizationCVE-2023-35051 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Constant Contact Forms: Missing AuthorizationCVE-2023-34387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.
- Product
- Constant Contact Forms
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Constant Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Formidable Forms: Missing AuthorizationCVE-2022-45806 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.
- Product
- Formidable Forms
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.