Read the docs

Calderaforms

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Calderaforms records in CISA KEV

No Calderaforms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Caldera Forms 2 records LOW

Records

2 records

TI-2022-00784 CVE-2022-0879 · GHSA-2q65-vx7q-jhcr

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Priority LOW 30

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01165 Published 2022-04-18 Fixed in 1.9.7 CWE-79
TI-2021-07176 CVE-2021-24896 · GHSA-gp35-882c-rhqq

Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-12-13 Fixed in 1.9.5 CWE-79
Open these records in search →