Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: funnelforms Component: Funnelforms Clear all filters
TI-2023-04956 CVE-2023-5385 · GHSA-xfgh-jcpr-8fw6

Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04958 CVE-2023-5387 · GHSA-qr7r-qwxc-r4jm

Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04987 CVE-2023-5416 · GHSA-3w3f-4842-3p4c

Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04982 CVE-2023-5411 · GHSA-4c25-gwp9-9c2h

Funnelforms Free <= 3.4 - Missing Authorization to Post Modification

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04986 CVE-2023-5415 · GHSA-hg4j-6gr9-jq8g

Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation

Priority LOW 21

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00476 Published 2023-11-22 No fix listed CWE-862
TI-2023-04989 CVE-2023-5419 · GHSA-fmq6-2658-x7vm

Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04957 CVE-2023-5386 · GHSA-wfpw-fx46-r3pf

Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

Priority LOW 29

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00481 Published 2023-11-22 No fix listed CWE-862
TI-2023-04988 CVE-2023-5417 · GHSA-m2j7-px25-h5hj

Funnelforms Free <= 3.4 - Missing Authorization to Category Update

Priority LOW 20

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00466 Published 2023-11-22 No fix listed CWE-862
TI-2023-04559 CVE-2023-4950 · GHSA-2q77-j9qq-67hg

Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting

Priority MEDIUM 60

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2023-10-16 Fixed in 3.4