CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6412 – HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF
https://notcve.org/view.php?id=CVE-2024-6412
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.33. This is due to missing or incorrect nonce validation on the process_bulk_action() function. This makes it possible for unauthenticated attackers to perform bulk actions like deleting forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/9eb0dad6-3c19-4fe4-a20d-d45b51410444 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6243 – HTML Forms < 1.3.33 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6243
The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled. El complemento de WordPress HTML Forms anterior a 1.3.33 no sanitiza ni escapa las entradas de mensajes del formulario, lo que permite a usuarios con altos privilegios, como administradores, realizar ataques de Cross Site Scripting almacenado (XSS) incluso cuando la capacidad unfiltered_html está deshabilitada. The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50836 – WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50836
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('cross-site Scripting') en ibericode HTML Forms permite almacenar XSS. Este problema afecta a HTML Forms: desde n/a hasta 1.3.28. The HTML Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/html-forms/wordpress-html-forms-plugin-1-3-28-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3689 – HTML Forms < 1.3.25 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2022-3689
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users El complemento HTML Forms de WordPress anterior a 1.3.25 no escapa correctamente de un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por usuarios con altos privilegios. The HTML Forms plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.3.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/e9c551a3-7482-4421-8197-5886d028776c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •