Read the docs

funnelforms

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

funnelforms records in CISA KEV

No funnelforms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Funnelforms 11 records MEDIUM Funnelforms Free 5 records LOW

Records

11 records in Funnelforms · all components

TI-2023-04559 CVE-2023-4950 · GHSA-2q77-j9qq-67hg

Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

Priority MEDIUM 60

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2023-10-16 Fixed in 3.4
TI-2023-04957 CVE-2023-5386 · GHSA-wfpw-fx46-r3pf

Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

Priority LOW 29

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00481 Published 2023-11-22 No fix listed CWE-862
TI-2023-04987 CVE-2023-5416 · GHSA-3w3f-4842-3p4c

Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04986 CVE-2023-5415 · GHSA-hg4j-6gr9-jq8g

Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04958 CVE-2023-5387 · GHSA-qr7r-qwxc-r4jm

Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04989 CVE-2023-5419 · GHSA-fmq6-2658-x7vm

Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04988 CVE-2023-5417 · GHSA-m2j7-px25-h5hj

Funnelforms Free <= 3.4 - Missing Authorization to Category Update

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04982 CVE-2023-5411 · GHSA-4c25-gwp9-9c2h

Funnelforms Free <= 3.4 - Missing Authorization to Post Modification

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04956 CVE-2023-5385 · GHSA-xfgh-jcpr-8fw6

Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
Open these records in search →