Mondula2016 Multi Step Form vulnerabilities

3 vulnerabilities

Known vulnerabilities in Mondula2016 Multi Step Form, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.2CVE-2025-9515mondula2016multi step form+1
EPSS score
0.66%
The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.5.3CVE-2024-12427mondulamulti_step_form+2
EPSS score
0.40%
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.9.8CVE-2024-50428mondulamulti_step_form+2
EPSS score
0.33%
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.