Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: funnelforms Component: Funnelforms Free Clear all filters
TI-2024-05431 CVE-2024-5857 · GHSA-qhm7-j2q7-2p2f

Missing authorization in funnelforms Interactive Contact Form and Multi Step Form Builder…

Priority LOW 30

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00317 Published 2024-08-29 No fix listed CWE-862
TI-2024-06901 CVE-2024-7447 · GHSA-q7v4-578f-ph8j

Missing authorization in funnelforms Interactive Contact Form and Multi Step Form Builder…

Priority LOW 30

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_a…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00402 Published 2024-08-28 No fix listed CWE-862
TI-2023-05520 CVE-2023-5990 · GHSA-cpc7-5gxx-6rf4

Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF

Priority LOW 28

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow att…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0027 Published 2023-12-04 Fixed in 3.4.2 CWE-352