FL
Vendor
Fluentforms
19
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-10646 | CF Contact Form Fluentforms | 6.1 | Dec 14 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject |
| CVE-2024-9651 | CF Contact Form Fluentforms | 6.1 | Dec 9 | Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS |
| CVE-2024-9528 | CF Contact Form Fluentforms | 4.8 | Oct 5 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting |
| CVE-2024-5053 | CF Contact Form Fluentforms | 4.3 | Sep 1 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification |
| CVE-2024-6703 | CF Contact Form Fluentforms | 5.4 | Jul 27 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields |
| CVE-2024-6518 | CF Contact Form Fluentforms | 4.4 | Jul 27 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2024-6520 | CF Contact Form Fluentforms | 4.4 | Jul 27 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2024-6521 | CF Contact Form Fluentforms | 4.4 | Jul 27 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2024-4157 | CF Contact Form Fluentforms | 8.8 | May 22 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues |
| CVE-2024-4709 | CF Contact Form Fluentforms | 6.4 | May 18 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-2772 | CF Contact Form Fluentforms | 5.4 | May 18 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting |
| CVE-2024-2782 | CF Contact Form Fluentforms | 7.5 | May 18 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation |
| CVE-2024-2771 | CF Contact Form Fluentforms | 9.8 | May 18 | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation |
| CVE-2023-6957 | CF Contact Form Fluentforms | 5.4 | Mar 13 | Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-0618 | CF Contact Form Fluentforms | 4.8 | Jan 27 | Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title |
| CVE-2023-24410 | CF Contact Form Fluentforms | 9.8 | Oct 31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form… |
| CVE-2023-0546 | CF Contact Form Fluentforms | 5.4 | Apr 10 | The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in… |
| CVE-2022-3463 | CF Contact Form Fluentforms | 9.8 | Nov 7 | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection |
| CVE-2021-34620 | CF Contact Form Fluentforms | 8.8 | Jul 7 | The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a… |
