CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48763 – WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-48763
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4. Neutralización inadecuada de etiquetas HTML relacionadas con secuencias de comandos en una página web (la vulnerabilidad XSS básica en Crocoblock JetFormBuilder permite la inyección de código. Este problema afecta a JetFormBuilder: desde n/a hasta 3.1.4. The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to content injection in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to inject content onto the site. • https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-1-4-content-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37866 – WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability
https://notcve.org/view.php?id=CVE-2023-37866
Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8. La vulnerabilidad de gestión de privilegios incorrecta en Crocoblock JetFormBuilder permite la escalada de privilegios. Este problema afecta a JetFormBuilder: desde n/a hasta 3.0.8. The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.0.8. This is due to insufficient restrictions on the form builder. • https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-8-authenticated-privilege-escalation-vulnerability?_s_id=cve • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33212 – WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-33212
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions. The JetFormBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.6. This is due to missing or incorrect nonce validation on the 'do_admin_action' function. This makes it possible for unauthenticated attackers to perform various administrative tasks in the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •