CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3834 – Google Forms <= 0.95 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-3834
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). El complemento Google Forms de WordPress hasta la versión 0.95 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scripting (XSS) Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio). The Google Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 0.95 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/1dbe0f24-b757-49fe-846f-7c259df9f361 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20988 – Google Forms <= 0.93 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-20988
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. El complemento wpgform en versiones anteriores a 0.94 para WordPress tiene inyección eval en el cálculo CAPTCHA. • https://wordpress.org/plugins/wpgform/#developers • CWE-94: Improper Control of Generation of Code ('Code Injection') •