Skip to content
OpenAdvisories

Vendor

roxnor

94 known vulnerabilities.

Products

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor 23 ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor 19 FundEngine 6 Wp Social Login and Register Social Counter 6 WP Ultimate Review 6 Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers 5 ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets 5 EmailKit – Email Customizer for WooCommerce & WP 4 FundEngine – Donation and Crowdfunding Platform 3 ElementsKit Elementor addons Lite 3 GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools 3 Metform 3 GetGenie 3 PopupKit 2 MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor 1 EmailKit 1 Rox Appointment Booking – Event, Calendar & Appointment Scheduling 1
All Critical High Medium Low Exploited only Public exploit

94 results · Feed

  • Medium 4.3
    CVE-2023-0692

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • High 8.3
    CVE-2023-0721

    Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution …

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  • Medium 5.4
    CVE-2023-0708

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contrib…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 4.9
    CVE-2023-0710

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated …

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 4.3
    CVE-2023-0691

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obta…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 6.5
    CVE-2023-0688

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtai…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 6.5
    CVE-2023-1843

    Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unau…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  • Medium 5.4
    CVE-2023-0709

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contribu…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 5.4
    CVE-2023-0695

    Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level …

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 6.5
    CVE-2023-0694

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensiti…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • Medium 6.5
    CVE-2023-0693

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • High 7.2
    CVE-2023-0084 Public exploit EPSS 29%

    Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  • Medium 5.3
    CVE-2023-0085

    Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it …

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  • High 7.5
    CVE-2022-1442 Public exploit Scanner template

    Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure

    The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party …

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS