CveMateVulnerability intelligence

Rednao vulnerabilities

23 vulnerabilities

Known vulnerabilities in Rednao products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.

Products

7

Smart Forms8 vulnerabilities
Woocommerce Pdf Invoice Builder7 vulnerabilities
Donations Made Easy Smart Donations6 vulnerabilities
Smart Donations2 vulnerabilities
Extra Product Options Builder For Woocommerce1 vulnerabilities
PDF Builder For Wpforms1 vulnerabilities
Woocommerce PDF Invoice Builder, Create Invoices, Packing Slips And More1 vulnerabilities

CVE-2022-0163rednaosmart_forms+24y ago07-03-2022 08:16

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.CVE-2024-1306rednaosmart_forms+22y ago15-04-2024 05:00

The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.CVE-2024-1307rednaosmart_forms+22y ago15-04-2024 05:00

The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions CVE-2024-1905rednaosmart_forms+22y ago29-04-2024 06:00

The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2024-31940rednaoextra product options builder for woocommerce+12y ago15-04-2024 09:15

Cross-Site Request Forgery (CSRF) vulnerability in RedNao Extra Product Options Builder for WooCommerce.This issue affects Extra Product Options Builder for WooCommerce: from n/a through 1.2.104.CVE-2024-29820rednaopdf builder for wpforms+12y ago27-03-2024 06:54

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88.CVE-2024-33593rednaosmart_forms+12y ago29-04-2024 10:09

Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91.CVE-2019-5924rednaosmart_forms+17y ago12-03-2019 21:00

Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.CVE-2023-40207rednaodonations_made_easy_-_smart_donations+12y ago06-11-2023 08:00

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL Injection.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.CVE-2023-40664rednaodonations_made_easy_-_smart_donations+23y ago27-09-2023 05:50

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.CVE-2023-51486rednaowoocommerce_pdf_invoice_builder+12y ago16-03-2024 01:05

Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.CVE-2023-47550rednaodonations_made_easy_-_smart_donations+12y ago14-11-2023 20:03

Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations allows Stored XSS.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.CVE-2023-47551rednaodonations_made_easy_-_smart_donations+12y ago18-11-2023 21:50

Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.CVE-2023-4160edgarrojaspdf builder for woocommerce. create invoices,packing slips and more+23y ago31-08-2023 05:33

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.CVE-2023-4245edgarrojaspdf builder for woocommerce. create invoices,packing slips and more+23y ago31-08-2023 05:33

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.CVE-2023-4161edgarrojaspdf builder for woocommerce. create invoices,packing slips and more+23y ago31-08-2023 05:33

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.CVE-2023-7203rednaosmart_forms+22y ago27-02-2024 08:30

The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.CVE-2023-46076rednaowoocommerce_pdf_invoice_builder+22y ago26-10-2023 12:05

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102 versions.CVE-2023-38475rednaodonations_made_easy_-_smart_donations+11y ago13-12-2024 14:23

Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.CVE-2023-49856edgarrojassmart forms+21y ago09-12-2024 11:30

Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.