Read the docs

WS Form

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

WS Form records in CISA KEV

No WS Form vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ws Form 6 records LOW

Records

6 records in Ws Form · all components

TI-2023-04993 CVE-2023-5424 · GHSA-cqx6-vqmj-2pph

WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

Priority LOW 39

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00493 Published 2024-06-07 No fix listed CWE-1236
TI-2024-12550 CVE-2024-13509 · GHSA-qqrp-rh67-96r2

WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 38

The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00368 Published 2025-01-28 No fix listed CWE-79
TI-2023-28574 CVE-2023-52135 · GHSA-3f3f-5w2h-wvgq

WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Co…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00478 Published 2023-12-29 No fix listed CWE-89
TI-2022-07951 CVE-2022-23988 · GHSA-j8j2-69r7-q88p

WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 32

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02231 Published 2022-02-28 Fixed in 1.8.176 CWE-79
TI-2024-09865 CVE-2024-10647 · GHSA-hr4g-wc9q-9jwx

WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL

Priority LOW 27

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all ver…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00317 Published 2024-11-06 No fix listed CWE-79
TI-2022-07950 CVE-2022-23987 · GHSA-4393-ch2m-6pmx

WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capabilit…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-02-28 Fixed in 1.8.176 CWE-79
Open these records in search →