Overview 648 matches · 17 in Waratek scope · 1 protected · 27 exploited · 3 CISA KEV · 50 public PoC · 8 EPSS ≥ 0.5
648matches
17in Waratek scope2.6%
1protected0.2%
27exploited4.2%
3CISA KEV0.5%
50public PoC7.7%
8EPSS ≥ 0.51.2%
Protected by Waratek
1
0.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
16
2.5%
Outside Waratek scope
15
2.3%
Not applicable
616
95.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.2%
partly blocked
0
0.0%
not blocked
647
99.8%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 149 / year
20041
Not applicable1
High1
not blocked1
No public exploit1
20055
Not applicable5
High2
Medium2
Low1
not blocked5
Working exploit published1
No public exploit4
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20071
Not applicable1
High1
not blocked1
No public exploit1
20084
Not applicable4
High3
Medium1
not blocked4
Exploited1
Working exploit published2
No public exploit1
20091
Not applicable1
High1
not blocked1
Working exploit published1
20108
Not applicable8
High2
Medium5
Low1
not blocked8
Working exploit published7
No public exploit1
20115
Not applicable5
High2
Medium3
not blocked5
Working exploit published1
No public exploit4
201213
Not applicable13
High9
Medium2
Low2
not blocked13
Working exploit published3
No public exploit10
201319
Not applicable19
High6
Medium9
Low4
not blocked19
Working exploit published2
No public exploit17
201433
No exploit published2
Outside Waratek scope10
Not applicable21
High15
Medium17
Low1
not blocked33
Exploited1
Working exploit published3
No public exploit29
20159
Not applicable9
High4
Medium5
not blocked9
Working exploit published1
No public exploit8
20168
Not applicable8
Critical1
High3
Medium3
Low1
not blocked8
Working exploit published1
No public exploit7
201711
Not applicable11
Critical1
High4
Medium5
Low1
not blocked11
Exploited2
No public exploit9
201841
Not applicable41
Critical3
High18
Medium19
Low1
not blocked41
Exploited1
Working exploit published4
No public exploit36
201944
No exploit published1
Outside Waratek scope4
Not applicable39
Critical11
High10
Medium23
not blocked44
Exploited2
Working exploit published2
Proof of concept only1
No public exploit39
202036
Outside Waratek scope1
Not applicable35
Critical8
High11
Medium14
Low3
not blocked36
No public exploit36
202134
Not applicable34
Critical1
High9
Medium24
not blocked34
Exploited3
Working exploit published1
No public exploit30
202227
Not applicable27
Critical3
High10
Medium14
not blocked27
Exploited2
Working exploit published1
Proof of concept only5
No public exploit19
202399
Protected by Waratek1
Not applicable98
Critical10
High24
Medium64
Low1
blocked by ARMR today1
not blocked98
Exploited4
Working exploit published4
Proof of concept only22
No public exploit69
2024149
Not applicable149
Critical13
High48
Medium87
Low1
not blocked149
Exploited7
Working exploit published3
Proof of concept only19
No public exploit120
202574
No exploit published3
Not applicable71
Critical13
High16
Medium40
Low5
not blocked74
Exploited3
Proof of concept only17
No public exploit54
202624
No exploit published10
Not applicable14
Critical10
High5
Medium9
not blocked24
Exploited1
Proof of concept only1
No public exploit22
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-10862 | Medium | 2024-12-25 | Not applicable | No public exploit | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_params' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited via CSRF due to a lack of nonce validation on the get_table_records AJAX action. |
| CVE-2023-40203 | High | 2024-12-13 | Not applicable | No public exploit | Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4. |
| CVE-2023-35051 | High | 2024-12-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7. |
| CVE-2022-45806 | Critical | 2024-12-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4. |
| CVE-2024-11052 | High | 2024-12-12 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-11205 | High | 2024-12-10 | Not applicable | No public exploit | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions. |
| CVE-2024-54223 | Medium | 2024-12-09 | Not applicable | No public exploit | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1. |
| CVE-2024-54217 | Medium | 2024-12-09 | Not applicable | No public exploit | Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1. |
| CVE-2023-49856 | High | 2024-12-09 | Not applicable | No public exploit | Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84. |
| CVE-2024-54216 | High | 2024-12-06 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2. |
| CVE-2024-53808 | High | 2024-12-06 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows SQL Injection.This issue affects NEX-Forms: from n/a through <= 8.7.8. |
| CVE-2024-40745 | Medium | 2024-12-04 | Not applicable | No public exploit | Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. |
| CVE-2024-40744 | Critical | 2024-12-04 | Not applicable | No public exploit | Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. |
| CVE-2024-11897 | Medium | 2024-12-04 | Not applicable | No public exploit | The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-10521 | Medium | 2024-11-27 | Not applicable | No public exploit | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-10471 | Medium | 2024-11-26 | Not applicable | No public exploit | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2024-7056 | Low | 2024-11-25 | Not applicable | No public exploit | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2024-11188 | Medium | 2024-11-23 | Not applicable | No public exploit | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-9768 | Medium | 2024-11-21 | Not applicable | Proof of concept only | The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2024-8726 | Medium | 2024-11-20 | Not applicable | No public exploit | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-50515 | Medium | 2024-11-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. |
| CVE-2024-50514 | Medium | 2024-11-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. |
| CVE-2024-6628 | Medium | 2024-11-16 | Not applicable | No public exploit | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.9.9. This is due to missing or incorrect nonce validation when deleting form submissions. This makes it possible for unauthenticated attackers to delete form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-9614 | Medium | 2024-11-13 | Not applicable | No public exploit | The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-10717 | Medium | 2024-11-13 | Not applicable | No public exploit | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license function in all versions up to, and including, 3.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. Note: This issue can also be used to add arbitrary options with an empty value. |
| CVE-2024-10593 | Medium | 2024-11-13 | Not applicable | No public exploit | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This makes it possible for unauthenticated attackers to delete WPForm logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-10013 | High | 2024-11-13 | Not applicable | No public exploit | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability. |
| CVE-2024-6626 | Medium | 2024-11-06 | Not applicable | No public exploit | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions. |
| CVE-2024-41741 | Medium | 2024-11-01 | Not applicable | No public exploit | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system. |
| CVE-2024-41738 | Medium | 2024-11-01 | Not applicable | No public exploit | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques. |
| CVE-2024-38748 | Critical | 2024-11-01 | Not applicable | No public exploit | Access Control vulnerability in TheInnovs EleForms allows . This issue affects EleForms: from n/a through 2.9.9.9. |
| CVE-2024-37463 | Critical | 2024-11-01 | Not applicable | No public exploit | Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5. |
| CVE-2024-9700 | Medium | 2024-10-31 | Not applicable | No public exploit | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauthenticated attackers to modify other user's quiz submissions. |
| CVE-2024-10402 | High | 2024-10-26 | Not applicable | No public exploit | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms. |
| CVE-2024-49615 | High | 2024-10-20 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0. |
| CVE-2024-8740 | Medium | 2024-10-18 | Not applicable | No public exploit | The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-9352 | Medium | 2024-10-17 | Not applicable | No public exploit | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-9351 | Medium | 2024-10-17 | Not applicable | No public exploit | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-47389 | High | 2024-10-05 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 8.7.3. |
| CVE-2024-47377 | Medium | 2024-10-05 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12. |
| CVE-2024-3866 | Medium | 2024-09-25 | Not applicable | No public exploit | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" for a targeted form to be enabled. However, there is no setting available to the attacker or even an administrator-level user to enable this mode. The mode is only enabled during a required update, which is a very short window of time. Additionally, because of the self-based nature of this vulnerability, attackers would have to rely on additional techniques to execute a supplied payload in the context of targeted user. |
| CVE-2024-43999 | Medium | 2024-09-18 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11. |
| CVE-2024-44063 | Medium | 2024-09-15 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0. |
| CVE-2024-8246 | High | 2024-09-14 | Not applicable | No public exploit | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators. |
| CVE-2024-1596 | High | 2024-09-07 | Not applicable | No public exploit | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-7692 | Medium | 2024-09-02 | Not applicable | Proof of concept only | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2024-7691 | Medium | 2024-09-02 | Not applicable | Proof of concept only | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators. |
| CVE-2024-7354 | Medium | 2024-09-02 | Not applicable | Working exploit published | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2024-5857 | Medium | 2024-08-29 | Not applicable | No public exploit | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to delete arbitrary media files. |
| CVE-2024-7447 | Medium | 2024-08-28 | Not applicable | No public exploit | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist. |
| CVE-2024-6312 | Medium | 2024-08-28 | Not applicable | No public exploit | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. |
| CVE-2024-6311 | High | 2024-08-28 | Not applicable | No public exploit | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. |
| CVE-2024-39628 | High | 2024-08-26 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6. |
| CVE-2024-7484 | High | 2024-08-06 | Not applicable | No public exploit | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. |
| CVE-2024-6725 | Medium | 2024-07-31 | Not applicable | No public exploit | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-6412 | Medium | 2024-07-31 | Not applicable | Proof of concept only | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks |
| CVE-2024-6243 | Medium | 2024-07-22 | Not applicable | Proof of concept only | The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled. |
| CVE-2024-38773 | Critical | 2024-07-22 | Not applicable | Working exploit published | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17. |
| CVE-2024-37512 | Medium | 2024-07-21 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10. |
| CVE-2024-37920 | High | 2024-07-20 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Repute InfoSystems ARForms Form Builder allows Reflected XSS.This issue affects ARForms Form Builder: from n/a through 1.6.7. |
| CVE-2024-37934 | Critical | 2024-07-09 | Not applicable | No public exploit | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4. |
| CVE-2022-45803 | High | 2024-06-21 | Not applicable | No public exploit | Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Builder Plugin – Gutenberg Forms: from n/a through 2.2.8.3. |
| CVE-2023-38393 | High | 2024-06-19 | Not applicable | Proof of concept only | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
| CVE-2023-38386 | Critical | 2024-06-19 | Not applicable | No public exploit | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
| CVE-2023-51377 | Medium | 2024-06-14 | Not applicable | No public exploit | Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3. |
| CVE-2024-0427 | Medium | 2024-06-12 | Not applicable | Proof of concept only | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions. |
| CVE-2023-51524 | High | 2024-06-12 | Not applicable | No public exploit | Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18. |
| CVE-2024-23521 | Medium | 2024-06-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10. |
| CVE-2024-35742 | High | 2024-06-10 | Not applicable | No public exploit | Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0. |
| CVE-2024-35661 | Critical | 2024-06-09 | Not applicable | No public exploit | Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2. |
| CVE-2024-32705 | High | 2024-06-09 | Not applicable | Exploited | Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4. |
| CVE-2024-32704 | High | 2024-06-09 | Not applicable | Exploited | Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4. |
| CVE-2024-32703 | High | 2024-06-09 | Not applicable | Exploited | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4. |
| CVE-2024-30512 | Critical | 2024-06-09 | Not applicable | No public exploit | Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20. |
| CVE-2024-4621 | Medium | 2024-06-07 | Not applicable | Proof of concept only | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) |
| CVE-2024-4620 | Critical | 2024-06-07 | Not applicable | Exploited | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form |
| CVE-2024-5324 | High | 2024-06-06 | Not applicable | Exploited | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator. |
| CVE-2024-5149 | Medium | 2024-06-05 | Not applicable | No public exploit | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification. |
| CVE-2024-2368 | Medium | 2024-06-05 | Not applicable | No public exploit | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-25095 | High | 2024-06-04 | Not applicable | No public exploit | Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0. |
| CVE-2024-35239 | Medium | 2024-05-28 | Not applicable | No public exploit | Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13). |
| CVE-2024-32830 | High | 2024-05-17 | Not applicable | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8. |
| CVE-2024-23522 | Medium | 2024-05-17 | Not applicable | No public exploit | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7. |
| CVE-2024-3892 | High | 2024-05-15 | Not applicable | No public exploit | A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system. |
| CVE-2024-31270 | High | 2024-05-08 | Not applicable | No public exploit | Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1. |
| CVE-2024-2082 | High | 2024-05-02 | Not applicable | No public exploit | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-2043 | Medium | 2024-05-02 | Not applicable | No public exploit | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for unauthenticated attackers to view form submissions. |
| CVE-2024-33593 | Medium | 2024-04-29 | Not applicable | No public exploit | Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91. |
| CVE-2024-1905 | Medium | 2024-04-29 | Not applicable | No public exploit | The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) |
| CVE-2024-32706 | High | 2024-04-24 | Not applicable | Exploited | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4. |
| CVE-2024-32702 | High | 2024-04-24 | Not applicable | Exploited | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4. |
| CVE-2023-36505 | High | 2024-04-17 | Not applicable | No public exploit | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. |
| CVE-2024-31378 | High | 2024-04-15 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.1. |
| CVE-2024-1307 | Medium | 2024-04-15 | Not applicable | Proof of concept only | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions |
| CVE-2024-1306 | Medium | 2024-04-15 | Not applicable | Proof of concept only | The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk. |
| CVE-2024-31272 | Medium | 2024-04-12 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1. |
| CVE-2024-29220 | Medium | 2024-04-11 | Not applicable | No public exploit | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. |
| CVE-2024-26019 | Medium | 2024-04-11 | Not applicable | No public exploit | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. |
| CVE-2024-25572 | High | 2024-04-11 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. |
| CVE-2024-1812 | High | 2024-04-09 | Not applicable | No public exploit | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. |