WS Form Pro

4 results · Feed

• High 7.2
  CVE-2024-13509

  WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting

  The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic…

  westguard WS Form WS Form LITE – Drag & Drop Contact Form Builder WS Form Pro
  Jan 28, 2025
• Medium 4.7
  CVE-2023-5424

  WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

  The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are dow…

  westguard WS Form WS Form LITE – Drag & Drop Contact Form Builder WS Form Pro Web / CMS
  Jun 7, 2024
• Unscored —
  CVE-2022-23988 Public exploit

  WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting

  The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

  WS Form WS Form Pro WS Form LITE – Drag & Drop Contact Form Builder for WordPress Web / CMS
  Feb 28, 2022
• Unscored —
  CVE-2022-23987

  WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

  The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

  WS Form WS Form Pro WS Form LITE – Drag & Drop Contact Form Builder for WordPress Web / CMS
  Feb 28, 2022