CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27460 – WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerability
https://notcve.org/view.php?id=CVE-2023-27460
Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34. Vulnerabilidad de autorización faltante en CodePeople, paypaldev CP Contact Form with Paypal permite el uso indebido de la funcionalidad. Este problema afecta a CP Contact Form with Paypal: desde n/a hasta 1.3.34. The CP Contact Form with Paypal plugin for WordPress is vulnerable to missing authorization on the 'cpcfwpp_feedback' function in versions up to, and including, 1.3.34. This allows authenticated attackers, with subscriber-level capabilities or above, to submit feedback to the plugin developers, which is intended to be a functionality reserved for administrators. • https://patchstack.com/database/vulnerability/cp-contact-form-with-paypal/wordpress-cp-contact-form-with-paypal-plugin-1-3-34-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-14785 – CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-14785
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter. El plugin "CP Contact Form with PayPal" anterior a versión 1.2.99 para WordPress, presenta una vulnerabilidad de tipo XSS en el asistente de publicación por medio del parámetro cp_contactformpp_id de wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1. • https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers https://www.pluginvulnerabilities.com/2019/06/24/reflected-cross-site-scripting-xss-vulnerability-in-cp-contact-form-with-paypal • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14784 – CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-14784
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. El plugin "CP Contact Form with PayPal" versiones anteriores a 1.2.98 para WordPress, presenta una vulnerabilidad de tipo XSS en la edición de CSS. The "CP Contact Form with PayPal" plugin before 1.3.02 for WordPress has XSS in CSS edition. • https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9233 – CP Contact Form with PayPal < 1.1.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-9233
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php. Las versiones anteriores a la 1.1.6 del plugin cp-contact-form-with-paypal (también llamado CP Contact Form with PayPal) para WordPress tienen Cross-Site Request Forgery (CSRF) con Cross-Site Scripting (XSS) resultante. Esto está relacionado con cp_contactformpp.php y cp_contactformpp_admin_int_list.inc.php. • http://seclists.org/fulldisclosure/2015/Jul/49 http://seclists.org/oss-sec/2015/q3/88 https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9234 – CP Contact Form with PayPal < 1.1.6 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-9234
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php. Las versiones anteriores a la 1.1.6 del plugin cp-contact-form-with-paypal (también llamado CP Contact Form with PayPal) para WordPress tienen una inyección SQL mediante el parámetro cp_contactformpp_id en cp_contactformpp.php. The CP Contact Form with PayPal plugin for WordPress is vulnerable to SQL Injection via the 'cp_contactformpp_id' parameter found in the 'cp_contactformpp.php' file in versions up to 1.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • http://seclists.org/fulldisclosure/2015/Jul/49 http://seclists.org/oss-sec/2015/q3/88 https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •