Vulnerabilities

TI-2024-11529 CVE-2024-12427 · GHSA-8979-rxc8-68vq

Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload

LOW 30

The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0041 Published 2025-01-16 No fix listed CWE-862

TI-2024-33861 CVE-2024-50428 · GHSA-hg4r-2fjv-5jm3

WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00326 Published 2024-10-29 No fix listed CWE-862

TI-2024-17005 CVE-2024-25905 · GHSA-633m-2q58-q23r

WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 24

Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00186 Published 2024-02-21 No fix listed CWE-352

TI-2023-27737 CVE-2023-50832 · GHSA-prq9-w48f-vwpv

WordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue affects Multi Step Form: from n/a through 1.7.13.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00402 Published 2023-12-21 No fix listed CWE-79

TI-2023-25868 CVE-2023-47758 · GHSA-gvpg-cp7v-vp77

WordPress Multi Step Form Plugin <= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-11-22 No fix listed CWE-352

TI-2022-03841 CVE-2022-4196 · GHSA-5r47-3q95-vm4q

Multi Step Form < 1.7.8 - Admin+ Stored XSS

MEDIUM 55

The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the un…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00475 Published 2023-01-09 Fixed in 1.7.8

TI-2018-10668 CVE-2018-14846 · GHSA-w6m4-38f4-rjq7

The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.

LOW 27

The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01097 Published 2018-12-20 No fix listed CWE-79

TI-2018-10345 CVE-2018-14430 · GHSA-pcm9-888p-jp88

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data…

LOW 30

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01255 Published 2018-07-25 No fix listed CWE-79

Vulnerabilities

Filters