CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0708 – Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
https://notcve.org/view.php?id=CVE-2023-0708
08 Jun 2023 — The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requi... • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0709 – Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
https://notcve.org/view.php?id=CVE-2023-0709
08 Jun 2023 — The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requir... • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0710 – Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
https://notcve.org/view.php?id=CVE-2023-0710
08 Jun 2023 — The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the Java... • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0721 – Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
https://notcve.org/view.php?id=CVE-2023-0721
08 Jun 2023 — The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. • https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1843 – Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization
https://notcve.org/view.php?id=CVE-2023-1843
04 May 2023 — The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure. • https://plugins.trac.wordpress.org/browser/metform/trunk/plugin.php#L544 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0085 – Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
https://notcve.org/view.php?id=CVE-2023-0085
02 Mar 2023 — The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail= • CWE-693: Protection Mechanism Failure •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0084 – Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-0084
02 Feb 2023 — The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page. WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from ... • https://www.exploit-db.com/exploits/51204 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 11%CPEs: 1EXPL: 2CVE-2022-1442 – Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2022-1442
23 Apr 2022 — The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. El plugin Metform para WordPress es vulnerable a una divulgación de información confidencial debido a un control de acceso i... • https://github.com/RandomRobbieBF/CVE-2022-1442 • CWE-862: Missing Authorization •