Blog

Alertes, guides et veille WordPress.

Vulnérabilités, maintenance et SEO WordPress, expliqués avec précision. Chaque article décrit le risque et la marche à suivre.

31815

Vulnérabilités (CVE)

Guides publiés

110

Publiés ce mois-ci

Filtre par plugin

a forms

Effacer

CritiqueCVSS 9.3

CVE-2024-32830

SSRF (Server-Side Request Forgery), non authentifié, dans Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (<= 2.8.8)

Plugin: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Versions: <= 2.8.8
CVSS: 9.3/10
Correctif: 2.8.9

Téléversement de fichier arbitraire, non authentifié, dans Forminator Forms – Contact Form, Payment Form & Custom Form Builder (<= 1.28.1)

Plugin: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Versions: <= 1.28.1
CVSS: 9.8/10
Correctif: 1.29.0

XSS stocké, authentifié (Contributeur+), dans Online Forms — Customizable Payment, Contact, Quiz, Survey Form Builder – Jotform (<= 1.3.1)

Plugin: Online Forms — Customizable Payment, Contact, Quiz, Survey Form Builder – Jotform
Versions: <= 1.3.1
CVSS: 6.4/10
Correctif: 1.3.2

XSS réfléchi dans Forminator Forms – Contact Form, Payment Form & Custom Form Builder (<= 1.15.2)

Plugin: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Versions: <= 1.15.2
CVSS: 6.1/10
Correctif: 1.15.4

Injection SQL, authentifié, dans Forminator Forms – Contact Form, Payment Form & Custom Form Builder (<= 1.29.2)

Plugin: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Versions: <= 1.29.2
CVSS: 9.1/10
Correctif: 1.29.3

Défaut de contrôle d'accès dans EleForms – All In One Form Integration including DB for Elementor (<= 2.9.9.7)

Plugin: EleForms – All In One Form Integration including DB for Elementor
Versions: <= 2.9.9.7
CVSS: 5.3/10
Correctif: 2.9.9.8

XSS stocké, non authentifié, dans EleForms – All In One Form Integration including DB for Elementor (<= 2.9.9.7)

Plugin: EleForms – All In One Form Integration including DB for Elementor
Versions: <= 2.9.9.7
CVSS: 7.2/10
Correctif: 2.9.9.8

XSS réfléchi dans WP Cost Estimation & Payment Forms Builder (<= 10.1.75)

Plugin: WP Cost Estimation & Payment Forms Builder
Versions: <= 10.1.75
CVSS: 6.1/10
Correctif: 10.1.76

CSRF (Cross-Site Request Forgery) dans Smart Forms – when you need more than just a contact form (<= 2.6.93)

Plugin: Smart Forms – when you need more than just a contact form
Versions: <= 2.6.93
CVSS: 4.3/10
Correctif: 2.6.94

Défaut de contrôle d'accès dans WP Cost Estimation & Payment Forms Builder (<= 10.1.76)

Plugin: WP Cost Estimation & Payment Forms Builder
Versions: <= 10.1.76
CVSS: 5.3/10
Correctif: 10.1.77

Injection SQL, authentifié (Administrateur+), dans Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook (<= 1.1.12)

Plugin: Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook
Versions: <= 1.1.12
CVSS: 9.1/10
Correctif: Aucun

CSRF (Cross-Site Request Forgery) dans Before And After: Lead Capture Forms For WordPress (<= 3.9)

Plugin: Before And After: Lead Capture Forms For WordPress
Versions: <= 3.9
CVSS: 4.3/10
Correctif: Aucun

11 avr. 2024

Lire

589 – 600 sur 1025 articles