Non notée
CVE-2021-24514 The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege…
Description
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Visual Form Builder 3.0 | premières → < 3.0.4 | 3.0.4 |
Autres CVE de Visual Form Builder
Les 7 CVE de Visual Form Builder →
CVE-2026-105974
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent…
4.3
Moyenne
CVE-2026-105973
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form…
4.3
Moyenne
CVE-2022-1046
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which…
Non notée
CVE-2022-0142
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or…
Non notée