CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22305 – WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)
https://notcve.org/view.php?id=CVE-2024-22305
17 Jan 2024 — Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36. Vulnerabilidad de omisión de autorización a través de clave controlada por el usuario en ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms. Este problema afecta a Contact Form builder with drag & drop for WordPress – Kali Forms:... • https://patchstack.com/database/vulnerability/kali-forms/wordpress-kali-forms-plugin-2-3-38-insecure-direct-object-references-idor-vulnerability?_s_id=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46083 – WordPress Kali Forms plugin <= 2.3.27 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-46083
16 Oct 2023 — Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop - Kali Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form builder with drag & drop - Kali Forms: from n/a through 2.3.27. The Contact Form builder with drag & drop - Kali Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing check on the run_form_process_checks function in versions up to, and including, 2.3.27. This makes ... • https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-3-27-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45275 – WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-45275
06 Oct 2023 — Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop - Kali Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form builder with drag & drop - Kali Forms: from n/a through 2.3.28. The Contact Form builder with drag & drop - Kali Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_log function in versions up to, and including, 2.3.28. This makes it possible for aut... • https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-contact-form-builder-with-drag-drop-plugin-2-3-27-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36720 – Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
https://notcve.org/view.php?id=CVE-2020-36720
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36712 – Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
https://notcve.org/view.php?id=CVE-2020-36712
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36717 – Kali Forms <= 2.1.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2020-36717
21 Aug 2020 — The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities • CWE-352: Cross-Site Request Forgery (CSRF) •