Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Linksoftwarellc Component: Html Forms Clear all filters
TI-2025-28988 CVE-2025-46236 · GHSA-cpvv-6mq2-5cpj

WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0022 Published 2025-04-22 No fix listed CWE-79
TI-2024-05952 CVE-2024-6412 · GHSA-jmmr-w66h-7p5r

HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF

Priority MEDIUM 62

The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00268 Published 2024-07-31 Fixed in 1.3.34 CWE-352
TI-2024-05790 CVE-2024-6243 · GHSA-4r8x-26vf-3hx6

HTML Forms < 1.3.33 - Admin+ Stored XSS

Priority MEDIUM 60

The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when th…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00353 Published 2024-07-22 Fixed in 1.3.33 CWE-79
TI-2023-27741 CVE-2023-50836 · GHSA-7gxc-74rc-72cp

WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00336 Published 2023-12-28 No fix listed CWE-79
TI-2022-03391 CVE-2022-3689 · GHSA-pj2v-wf83-5cr4

HTML Forms < 1.3.25 - Admin+ SQLi

Priority HIGH 67

The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01993 Published 2022-11-28 Fixed in 1.3.25 CWE-89