Vulnerabilities and security researches for tripetto

Jun 07, 2024

CVE, Research URL: CVE-2021-36895
Home page URL: Security reports for WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Application: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Date: Apr 27, 2022
Research Description: Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-4974
Home page URL: Security reports for WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Application: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Date: Oct 16, 2024
Research Description: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2025-22295
Home page URL: Security reports for WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Application: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Date: Jan 09, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through 8.0.5.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-13829
Home page URL: Security reports for WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Application: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Date: Feb 05, 2025
Research Description: The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Affected versions: Min -, max -.
Status: vulnerable