Strategy11 Team

10 results · Clear filters · Feed

• High 8.8
  CVE-2026-89435

  Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter

  The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to …

  Strategy11 Team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Web / CMS
  Oct 30, 2026
• High 7.5
  CVE-2026-15990

  Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter

  The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serv…

  Strategy11 Team Formidable Charts Web / CMS
  Aug 26, 2026
• High 7.2
  CVE-2026-18331

  Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

  The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient inp…

  Strategy11 Team Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More Web / CMS
  Aug 26, 2026
• High 7.1
  CVE-2026-28004

  WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

  Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

  Strategy11 Team Business Directory
  Aug 13, 2026
• High 7.5
  CVE-2026-5100

  AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions'

  The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi…

  Strategy11 Team AWP Classifieds Web / CMS
  May 5, 2026
• High 7.5
  CVE-2026-2890

  Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse

  The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete base…

  Strategy11 Team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Web / CMS
  Mar 13, 2026
• High 7.5
  CVE-2026-2576 Public exploit

  Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter

  The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied par…

  Strategy11 Team Business Directory Plugin – Easy Listing Directories for WordPress Web / CMS
  Feb 18, 2026
• High 7.1
  CVE-2025-31440

  WordPress Terms of Use plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

  Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through <= 2.0.

  Strategy11 Team Terms of Use
  Mar 28, 2025
• High 8.3
  CVE-2017-20192 Public exploit Scanner template

  Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting

  The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This m…

  Strategy11 Team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Web / CMS
  Oct 16, 2024
• High 7.4
  CVE-2023-5527

  Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection

  The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted inp…

  Strategy11 Team Business Directory Plugin – Easy Listing Directories for WordPress Web / CMS
  Jun 18, 2024