CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2836 – CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-2836
30 May 2023 — The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. El p... • https://github.com/Don-H50/wp-vul/blob/main/CPF-xss-exploit.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33311 – WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-33311
22 May 2023 — Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions. The Contact Form Entries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vx-entries' shortcode attributes in versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut... • https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31212 – WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2023-31212
22 May 2023 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0. Neutralización Inadecuada de Elementos Especiales utilizados en una vulnerabilidad de comando SQL ('Inyección SQL') en el CRM Perks Database para Contact Form 7, WPforms, Elementor forms contact-form-entrie... • https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-auth-sql-injection-sqli-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2527 – Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2023-2527
22 May 2023 — The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin The Integration for Contact Form 7 and Zoho CRM, Bigin plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar... • https://wpscan.com/vulnerability/8051142a-4e55-4dc2-9cb1-1b724c67574f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31095 – WordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection
https://notcve.org/view.php?id=CVE-2023-31095
26 Apr 2023 — URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8. Vulnerabilidad de redirección de URL a sitio no confiable ("Open Redirect") en CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. Este problema afecta a Integration for HubSpot and Contact Form 7, WPFo... • https://patchstack.com/database/vulnerability/cf7-hubspot/wordpress-integration-for-contact-form-7-hubspot-plugin-1-2-8-open-redirection-vulnerability?_s_id=cve • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25976 – WordPress Integration for Contact Form 7 and Zoho CRM, Bigin Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-25976
22 Feb 2023 — Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions. The Integration for Contact Form 7 and Zoho CRM, Bigin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the 'settings_page' function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a si... • https://patchstack.com/database/vulnerability/cf7-zoho/wordpress-integration-for-contact-form-7-and-zoho-crm-bigin-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3604 – Contact Form Entries < 1.3.0 - CSV Injection
https://notcve.org/view.php?id=CVE-2022-3604
21 Oct 2022 — The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. El complemento de WordPress Contact Form Entries anterior a 1.3.0 no valida los datos cuando se generan en un archivo CSV, lo que podría provocar una inyección de CSV. The Contact Form Entries plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.2.9 when outputting to a CSV file. This allows low-level attackers to embed untrusted i... • https://wpscan.com/vulnerability/300ebfcd-c500-464e-b919-acfeb72593de • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38467 – WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2022-38467
30 Sep 2022 — Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. Vulnerabilidad de cross site scripting (XSS) reflejado en CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. The CRM Perks Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.10 due to insufficient input sanitization and output escaping in the ~/templates/sample_file.php file. This makes it possible for unauthenticated attackers to inj... • https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25079 – Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25079
14 Nov 2021 — The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page El plugin Contact Form Entries de WordPress versiones anteriores a 1.2.4, no sanea y escapa de varios parámetros, como form_id, status, end_date, order, orderby y search antes de devolverlos a la página de administración WordPress Contact Form Entries plugin versions prior to 1.2.4 suffer from an una... • https://plugins.trac.wordpress.org/changeset/2629442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25080 – Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25080
05 Jan 2021 — The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry El plugin Contact Form Entries de WordPress versiones anteriores a 1.1.7, no comprueba, sanea y escapa de la dirección IP recuperada por medio de encabezados como CLIENT-IP y X-FORWARDED-FOR, permitiendo a atacantes ... • https://plugins.trac.wordpress.org/changeset/2450335 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •