Vulnerabilities

TI-2024-16321 CVE-2024-24804 · GHSA-gphg-348r-v598

WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00317 Published 2024-02-10 No fix listed CWE-79

TI-2023-06010 CVE-2023-6559 · GHSA-gp3f-cq56-47mc

MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion

MEDIUM 51

The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01313 Published 2023-12-16 No fix listed CWE-22

Vulnerabilities

Filters

WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion