Search
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-6133 | 1 Incsub | 1 Forminator | 2023-11-30 | N/A | 4.9 MEDIUM |
| The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed. | |||||
| CVE-2023-5119 | 1 Incsub | 1 Forminator | 2023-11-27 | N/A | 4.8 MEDIUM |
| The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup). | |||||
| CVE-2023-3134 | 1 Incsub | 1 Forminator | 2023-08-03 | N/A | 6.1 MEDIUM |
| The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks. | |||||
| CVE-2021-24700 | 1 Incsub | 1 Forminator | 2021-11-24 | 3.5 LOW | 4.8 MEDIUM |
| The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed | |||||