Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: themehunk Component: Contact Form & Lead Form Elementor Builder Clear all filters
TI-2024-09703 CVE-2024-10475 · GHSA-m8jc-qh4f-52fp

Lead Form Builder < 1.9.8 - Admin+ Stored XSS

Priority MEDIUM 55

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-S…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 1.9.8 CWE-79
TI-2024-03392 CVE-2024-3637 · GHSA-pvfc-97vc-2gh2

Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS

Priority MEDIUM 60

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00472 Published 2024-05-03 No fix listed CWE-79
TI-2022-07332 CVE-2022-23179 · GHSA-h9pp-v4f3-fp7x

Contact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scri…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00536 Published 2024-01-16 Fixed in 1.7.0 CWE-79
TI-2022-07333 CVE-2022-23180 · GHSA-vxm2-qvw6-qg48

Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update

Priority MEDIUM 53

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various setting…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0053 Published 2024-01-16 Fixed in 1.7.4 CWE-862
TI-2021-07246 CVE-2021-24967 · GHSA-rmpw-3qc7-gg2j

Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 30

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged i…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01186 Published 2021-12-27 Fixed in 1.6.4 CWE-79