Vulnerabilities and security researches forsimple-form simple-form

Jul 12, 2024

CVE, Research URL: CVE-2024-3113
Home page URL: Security reports for FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Application: FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Date: Jul 30, 2024
Research Description: The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions: max 2.12.2.
Status: vulnerable

Oct 15, 2026

CVE, Research URL: CVE-2026-104748
Home page URL: Security reports for FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Application: FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Date: Oct 14, 2026
Research Description: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Affected versions: max 3.10.1.
Status: vulnerable

Nov 01, 2026

CVE, Research URL: CVE-2026-118235
Home page URL: Security reports for FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Application: FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
Date: Oct 31, 2026
Research Description: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
Affected versions: max 3.11.0.
Status: vulnerable