Skip to content
OpenAdvisories

Vendor

Edgar Rojas

21 known vulnerabilities.

Products

PDF Builder for WooCommerce. Create invoices,packing slips and more 8 WooCommerce PDF Invoice Builder 4 Smart Forms – when you need more than just a contact form 3 Extra Product Options Builder for WooCommerce 2 Smart Forms 2 PDF Builder for WPForms 1 AIO Forms – Craft Complex Forms Easily 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.2
    CVE-2026-95816

    Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter

    The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output esca…

    Edgar Rojas Smart Forms – when you need more than just a contact form Web / CMS
  • High 7.1
    CVE-2026-32574

    WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

    Edgar Rojas Smart Forms
  • High 7.2
    CVE-2025-11889

    AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import

    The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.18. This makes it possible for authenticated atta…

    Edgar Rojas AIO Forms – Craft Complex Forms Easily Web / CMS
  • High 8.1
    CVE-2023-49856

    WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability

    Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.

    Edgar Rojas Smart Forms
  • High 8.8
    CVE-2023-3677

    WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export

    The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi…

    Edgar Rojas PDF Builder for WooCommerce. Create invoices,packing slips and more Web / CMS