Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2023-0695 |
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
CVSS: MEDIUM (5.4) EPSS Score: 0.06%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0694 |
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
CVSS: MEDIUM (6.5) EPSS Score: 0.06%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0692 |
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
CVSS: MEDIUM (4.3) EPSS Score: 0.06%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0691 |
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
CVSS: MEDIUM (4.3) EPSS Score: 0.06%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0688 |
Description: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
CVSS: MEDIUM (6.5) EPSS Score: 0.1%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0584 |
Description: The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.
CVSS: MEDIUM (4.3) EPSS Score: 0.06%
December 21st, 2024 (4 months ago)
|
|
CVE-2023-0292 |
Description: The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS: MEDIUM (5.4) EPSS Score: 0.61%
December 21st, 2024 (4 months ago)
|
|
CVE-2024-37962 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Fusion allows Stored XSS.This issue affects Fusion: from n/a through 1.6.1.
CVSS: MEDIUM (6.5) EPSS Score: 0.04%
December 20th, 2024 (4 months ago)
|
|
CVE-2024-12626 |
Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.
CVSS: CRITICAL (9.6) EPSS Score: 0.09%
December 20th, 2024 (4 months ago)
|
|
CVE-2024-12560 |
Description: The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
CVSS: MEDIUM (4.3) EPSS Score: 0.05%
December 20th, 2024 (4 months ago)
|