Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Calderaforms Component: Caldera Forms Clear all filters
TI-2022-00784 CVE-2022-0879 · GHSA-2q65-vx7q-jhcr

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Priority LOW 30

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01165 Published 2022-04-18 Fixed in 1.9.7 CWE-79
TI-2021-07176 CVE-2021-24896 · GHSA-gp35-882c-rhqq

Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-12-13 Fixed in 1.9.5 CWE-79