Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: wpvibes Component: Form Vibes Clear all filters
TI-2024-04932 CVE-2024-5309 · GHSA-wwwc-q9ch-83c7

Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions

Priority LOW 24

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00292 Published 2024-09-05 No fix listed CWE-862
TI-2024-04944 CVE-2024-5325 · GHSA-98qh-gr88-4vgm

Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data

Priority MEDIUM 41

The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of s…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00484 Published 2024-07-12 No fix listed CWE-89
TI-2022-03455 CVE-2022-3764 · GHSA-6px9-w6mg-x39x

Form Vibes < 1.4.5 - Admin+ SQLi

Priority HIGH 65

The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00981 Published 2024-01-16 Fixed in 1.4.6 CWE-89