Vulnerabilities

TI-2025-12030 CVE-2025-13159 · GHSA-353x-4wxr-qqh7

Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload

LOW 31

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00336 Published 2025-11-21 No fix listed CWE-79

TI-2025-23310 CVE-2025-32213 · GHSA-fgvc-pmvm-xpxw

WordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerability

LOW 29

Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.43.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00332 Published 2025-04-10 No fix listed CWE-862

TI-2023-25829 CVE-2023-47692 · GHSA-43fh-63xp-xhfw

WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00318 Published 2025-01-02 No fix listed CWE-862

Vulnerabilities

Filters

Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload

WordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerability

WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability