Vulnerabilities

TI-2024-09360 CVE-2024-10098 · GHSA-h58h-p5x5-v3wj

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

MEDIUM 47

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00419 Published 2025-05-15 Fixed in 2.6.3

TI-2023-24530 CVE-2023-45756 · GHSA-qxjh-36c6-ww4r

WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

LOW 32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline – Application Form Builder and Manager plugin <= 2.5.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00527 Published 2023-10-24 No fix listed CWE-79

TI-2023-10013 CVE-2023-24391 · GHSA-m25j-crjh-x2hf

WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <= 2.5 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-08-10 No fix listed CWE-79

Vulnerabilities

Filters

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)