Filtered by vendor Strategy11 Subscriptions
Filtered by product Formidable Forms Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-2877 1 Strategy11 1 Formidable Forms 2024-12-03 8.8 High
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
CVE-2024-9768 1 Strategy11 1 Formidable Forms 2024-11-26 4.8 Medium
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-0660 1 Strategy11 1 Formidable Forms 2024-11-21 6.1 Medium
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2023-1405 1 Strategy11 1 Formidable Forms 2024-11-21 7.5 High
The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
CVE-2017-20194 1 Strategy11 2 Formidable Form Builder, Formidable Forms 2024-10-31 5.3 Medium
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
CVE-2017-20192 1 Strategy11 1 Formidable Forms 2024-10-16 8.3 High
The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.