Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: CRM Perks Component: Crm Perks Forms Clear all filters
TI-2024-24967 CVE-2024-37463 · GHSA-vv32-h72m-mqmf

WordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerability

Priority MEDIUM 48

Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00451 Published 2024-11-01 No fix listed CWE-862
TI-2024-06934 CVE-2024-7484 · GHSA-pw97-grw5-hp3h

CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload

Priority LOW 35

The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2024-08-06 No fix listed CWE-434
TI-2024-20172 CVE-2024-30446 · GHSA-6826-vrr5-pj78

WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00336 Published 2024-03-29 No fix listed CWE-79
TI-2024-20223 CVE-2024-30499 · GHSA-5jvh-2rg4-779c

WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability

Priority LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00577 Published 2024-03-29 No fix listed CWE-89
TI-2023-28188 CVE-2023-51536 · GHSA-c3c7-9cj5-pr3c

WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms – WordPress Fo…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00336 Published 2024-02-01 No fix listed CWE-79
TI-2023-02657 CVE-2023-2836 · GHSA-w5rr-mc9h-5xqw

CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 23

The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00599 Published 2023-05-31 No fix listed CWE-79