Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Masdiblogs Component: Wp Ajax Contact Form Clear all filters
TI-2024-05386 CVE-2024-5809 · GHSA-vh4q-xf3f-7h4p

WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00359 Published 2024-07-30 No fix listed CWE-79
TI-2024-05385 CVE-2024-5808 · GHSA-jrjf-m2v9-j4qr

WP Ajax Contact Form <= 2.2.2 - Arbitrary Email Deletion via CSRF

Priority MEDIUM 53

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF att…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00219 Published 2024-07-30 No fix listed CWE-352