CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6243 – HTML Forms < 1.3.33 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6243
The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled. El complemento de WordPress HTML Forms anterior a 1.3.33 no sanitiza ni escapa las entradas de mensajes del formulario, lo que permite a usuarios con altos privilegios, como administradores, realizar ataques de Cross Site Scripting almacenado (XSS) incluso cuando la capacidad unfiltered_html está deshabilitada. The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50836 – WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50836
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('cross-site Scripting') en ibericode HTML Forms permite almacenar XSS. Este problema afecta a HTML Forms: desde n/a hasta 1.3.28. The HTML Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/html-forms/wordpress-html-forms-plugin-1-3-28-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32517 – WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.3 is vulnerable to Open Redirection
https://notcve.org/view.php?id=CVE-2023-32517
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3. Vulnerabilidad de redirección de URL a un sitio que no es de confianza ('Open Redirect') en PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder. Este problema afecta a MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: desde n/a hasta 4.0. 9.3. The MailChimp Subscribe Forms plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 4.0.9.3. This is due to the application failing to properly verify a user-supplied input parameter. • https://patchstack.com/database/vulnerability/mailchimp-subscribe-sm/wordpress-mailchimp-subscribe-forms-plugin-4-0-9-1-open-redirection-vulnerability?_s_id=cve • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3689 – HTML Forms < 1.3.25 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2022-3689
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users El complemento HTML Forms de WordPress anterior a 1.3.25 no escapa correctamente de un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por usuarios con altos privilegios. The HTML Forms plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.3.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/e9c551a3-7482-4421-8197-5886d028776c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18577 – Mailchimp For WP <= 4.1.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18577
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. El complemento mailchimp-for-wp versiones anterior a 4.1.8 para WordPress tiene XSS a través del valor de retorno de add_query_arg. • https://wordpress.org/plugins/mailchimp-for-wp/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •