Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Vfbpro Clear all filters
TI-2022-00943 CVE-2022-1046 · GHSA-fmjq-pj33-mxhg

Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htm…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-02 Fixed in 3.0.7 CWE-79
TI-2022-00085 CVE-2022-0142 · GHSA-g4v7-hfrx-hqf3

Visual Form Builder < 3.0.6 - CSV Injection

Priority MEDIUM 47

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02872 Published 2022-04-12 Fixed in 3.0.8 CWE-1236
TI-2022-00084 CVE-2022-0141 · GHSA-35m9-hm95-j6w7

Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF

Priority LOW 36

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00471 Published 2022-04-12 Fixed in 3.0.8 CWE-352
TI-2022-00083 CVE-2022-0140 · GHSA-rmwm-c9cm-59pw

Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure

Priority LOW 31

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0384 Published 2022-04-12 Fixed in 3.0.6 CWE-306
TI-2021-06801 CVE-2021-24514 · GHSA-x9p3-344r-7wm6

Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capa…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-10-25 Fixed in 3.0.4 CWE-79