The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWpforms Pro
APPWpforms< 1.7.7
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2024-11205HIGH8.5ten sam vendor
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit...
CVE-2023-7063HIGH7.2ten sam vendor
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission paramete...
CVE-2019-25145HIGH7.2ten sam vendor
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘pub...
CVE-2020-36919MEDIUM5.1ten sam vendor
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parame...
CVE-2024-11272MEDIUM6.1ten sam vendor
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise an...