CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1564 – Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1564
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed El plugin Form Maker by 10Web de WordPress versiones anteriores a 1.14.12, no sanea ni escapa de la configuración del Texto Personalizado, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando unfiltered_html no está permitido • https://wpscan.com/vulnerability/a487c7e7-667c-4c92-a427-c43cc13b348d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24526 – Form Maker < 1.13.60 - Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2021-24526
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue El plugin de WordPress Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder versiones anteriores a 1.13.60, no escapa de su Título de Formulario antes de mostrarlo en un atributo cuando se edita un formulario en el panel de administración, conllevando a un problema de tipo Cross-Site Scripting Almacenado y autenticado. • https://wpscan.com/vulnerability/17287d8a-ba27-42dc-9370-a931ef404995 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-10866 – Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2019-10866
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter. En el plugin de Form Maker anterior de la versión 1.13.3 para WordPress, es posible conseguir una inyección SQL en la función get_labels_parameters en el archivo form-maker/admin/models/Submissions_fm.php con un valor creado del parámetro /models/Submissioc. WordPress Form Maker plugin version 1.13.3 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/46958 http://seclists.org/fulldisclosure/2019/May/8 https://wordpress.org/plugins/form-maker/#developers https://wpvulndb.com/vulnerabilities/9286 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11590 – Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-11590
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized. El plugin Form Maker de 10Web anterior a la versión 1.13.5 para WordPress, permite CSRF por medio del parámetro action en el archivo wp-admin/admin-ajax.php., con la inclusión de archivos locales resultantes por el recorrido del directorio, porque puede haber una discrepancia entre el valor $ _ post [' Action '] y el $ _ Obtenga el valor [' Action '] y este último no se desinfecte. • http://seclists.org/fulldisclosure/2019/Apr/36 https://lists.openwall.net/full-disclosure/2019/04/05/11 https://wordpress.org/plugins/form-maker/#developers • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-352: Cross-Site Request Forgery (CSRF) CWE-829: Inclusion of Functionality from Untrusted Control Sphere •