Read the docs

INFINITUM FORM

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

INFINITUM FORM records in CISA KEV

No INFINITUM FORM vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Geo Controller 3 records HIGH

Records

7 records

TI-2024-03346 CVE-2024-3591 · GHSA-j9wj-h588-6g73

WordPress Geo Controller < 8.6.5 - PHP Object Injection

Priority HIGH 68

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00489 Published 2024-05-01 Fixed in 8.6.5 CWE-502
TI-2025-38431 CVE-2025-62109 · GHSA-4828-4rjm-75q4

WordPress Geo Controller plugin <= 8.9.4 - Sensitive Data Exposure vulnerability

Priority LOW 30

Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00285 Published 2025-12-09 No fix listed CWE-201
TI-2024-20177 CVE-2024-30451 · GHSA-pm5x-67pp-5cc7

WordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00351 Published 2024-03-29 No fix listed CWE-79
TI-2024-06841 CVE-2024-7381 · GHSA-4q7x-mgpp-gv6h

Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

Priority LOW 26

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2024-09-05 No fix listed CWE-862
TI-2024-06840 CVE-2024-7380 · GHSA-hffc-gcjh-mj4f

Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

Priority LOW 20

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00264 Published 2024-09-05 No fix listed CWE-862
Open these records in search →