CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45625 – Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-45625
Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator. The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.34.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://jvn.jp/en/jp/JVN65724976 https://plugins.trac.wordpress.org/changeset?new=3135507%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js&old=3111152%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js https://wordpress.org/plugins/forminator https://wpmudev.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31077 – Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection
https://notcve.org/view.php?id=CVE-2024-31077
Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition. Forminator anterior a 1.29.3 contiene una vulnerabilidad de inyección SQL. Si se explota esta vulnerabilidad, un atacante remoto autenticado con privilegios administrativos puede obtener y alterar cualquier información en la base de datos y provocar una condición de denegación de servicio (DoS). The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.29.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. • https://jvn.jp/en/jp/JVN50132400 https://wordpress.org/plugins/forminator https://wpmudev.com • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31857 – Forminator <= 1.15.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-31857
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser. Forminator anterior a 1.15.4 contiene una vulnerabilidad de Cross Site Scripting. Si se explota esta vulnerabilidad, un atacante remoto puede obtener información del usuario, etc. y alterar el contenido de la página en el navegador web del usuario. The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. • https://jvn.jp/en/jp/JVN50132400 https://wordpress.org/plugins/forminator https://wpmudev.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28890 – Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2024-28890
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition. Forminator anterior a 1.29.0 contiene una carga sin restricciones de archivos con una vulnerabilidad de tipo peligroso. Si se explota esta vulnerabilidad, un atacante remoto puede obtener información confidencial accediendo a archivos en el servidor, alterar el sitio que utiliza el complemento y provocar una condición de denegación de servicio (DoS). The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.28.1. • https://jvn.jp/en/jp/JVN50132400 https://wordpress.org/plugins/forminator https://wpmudev.com • CWE-434: Unrestricted Upload of File with Dangerous Type •