CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0085 – Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
https://notcve.org/view.php?id=CVE-2023-0085
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail= https://wordpress.org/plugins/metform https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9 • CWE-693: Protection Mechanism Failure •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0084 – Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-0084
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page. WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from a persistent cross site scripting vulnerability. • https://www.exploit-db.com/exploits/51204 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail= https://wordpress.org/plugins/metform/#description https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 2CVE-2022-1442 – Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2022-1442
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. El plugin Metform para WordPress es vulnerable a una divulgación de información confidencial debido a un control de acceso inapropiado en el archivo ~/core/forms/action.php que puede ser aprovechado por un atacante no autenticado para visualizar todas las claves y secretos de las API de terceros integradas como la de PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA y muchas más, en versiones hasta la 2.1.3 incluyéndola • https://github.com/RandomRobbieBF/CVE-2022-1442 https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php https://www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1?source=cve • CWE-862: Missing Authorization •