| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Jul 02, 2025, 04:07:39 | Entries count: 24 | |||
|
PDF Generator For Fluent Forms – The Contact Form Plugin
vulnerable
|
Jun 06, 2024, 21:06:01 |
Min -
Max 1.1.8
|
The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the header, PDF body and footer content parameters in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an admini... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Sep 01, 2024, 17:09:21 |
Min -
Max 5.1.19
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration ... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Oct 05, 2024, 22:10:49 |
Min -
Max 5.1.20
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Mar 23, 2025, 11:03:41 |
Min -
Max 6.0.0
|
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 3.6.67
|
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 4.3.13
|
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.10
|
The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by defau... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 4.3.25
|
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.0.0
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.17
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.16
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to d... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.7
|
The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installat... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.17
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.17
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated ... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 06, 2024, 22:06:25 |
Min -
Max 5.1.14
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-277... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Dec 15, 2024, 00:12:29 |
Min -
Max 5.2.7
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Apr 17, 2025, 19:04:10 |
Min -
Max 6.0.3
|
The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
SAFE & CERTIFIED
|
Nov 06, 2024, 16:11:23 |
Min 6.0.1
Max 6.0.4
|
Fluent Forms has passed a thorough security assessment and received the prestigious Plugin Security Certification (PSC) from CleanTalk, which guarantees users a secure environment for managing forms. Fluent Forms is a comprehensive and secure contact form builder designed for WordPress. With an intuitive drag-and-drop interface, Fluent Forms provides a wide range of features that are suitable for both beginners and advanced users. Recognized for its performance, Fluent Forms loads quickly without overloadin... | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Dec 09, 2024, 13:12:52 |
Min -
Max 5.2.1
|
The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jul 28, 2024, 07:07:04 |
Min -
Max 5.1.20
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jul 28, 2024, 07:07:04 |
Min -
Max 5.1.20
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jul 28, 2024, 07:07:04 |
Min -
Max 5.1.20
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jul 28, 2024, 07:07:04 |
Min -
Max 5.1.20
|
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
vulnerable
|
Jun 10, 2024, 12:06:26 |
Min -
Max 5.1.7
|
Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8. | |