Reputeinfosystems vulnerabilities, page 2

74 vulnerabilities

Known vulnerabilities in Reputeinfosystems products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.

5.6MediumCVE-2024-13785reputeinfosystems · contact form, survey, quiz & popup form builder – arforms +1 moreContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode ExecutionThe The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.EPSS0.28%7.1HighCVE-2024-1945reputeinfosystems · contact form, survey, quiz & popup form builder – arforms +1 moreARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option DeletionThe Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability.EPSS0.43%4.8MediumCVE-2024-11189reputeinfosystems · social_share_and_social_locker +2 moreSocial Share And Social Locker – ARSocial < 1.4.2 - Admin+ Stored XSSThe Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.33%6.5MediumCVE-2024-11726reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreAppointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL InjectionThe Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpress_form' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.50%5.3MediumCVE-2024-0969reputeinfosystems · armember +2 moreARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST APIThe ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Default Restriction" feature and view restricted post content.EPSS0.48%6.3MediumCVE-2024-0427reputeinfosystems · arforms +2 moreArforms < 6.4.1 - Reflected XSSThe ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.EPSS0.36%8HighCVE-2024-31270repute infosystems · arforms form builder +2 moreWordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.EPSS0.36%6.3MediumCVE-2024-31272repute infosystems · arforms form builder +2 moreWordPress ARForms Form Builder plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.EPSS0.18%5.4MediumCVE-2024-31296repute infosystems · bookingpress +2 moreWordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.EPSS0.32%10CriticalCVE-2024-4620reputeinfosystems · arforms +2 moreArForms < 6.6 - Unauthenticated RCEThe ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a formEPSS3.35%6.1MediumCVE-2024-4133reputeinfosystems · armember – membership plugin, content restriction, member levels, user profile & user signup +1 moreARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open RedirectThe ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.30. This is due to insufficient validation on the redirect url supplied via the redirect_to parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.EPSS0.53%4.8MediumCVE-2024-4621reputeinfosystems · arforms +2 moreArForms < 6.6 - Admin+ Stored XSSThe ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.35%7.1HighCVE-2024-37920repute infosystems · arforms form builder +2 moreWordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Repute InfoSystems ARForms Form Builder allows Reflected XSS.This issue affects ARForms Form Builder: from n/a through 1.6.7.EPSS0.33%6.4MediumCVE-2024-7703reputeinfosystems · armember – membership plugin, content restriction, member levels, user profile & user signup +1 moreARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadThe ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.EPSS1.14%9.8CriticalCVE-2024-7350reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreAppointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account TakeoverThe Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.EPSS0.66%5.9MediumCVE-2024-27995repute infosystems · armember – membership plugin, content restriction, member levels, user profile & user signup +2 moreWordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: from n/a through 4.0.23.EPSS0.33%6.5MediumCVE-2024-10540reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +2 moreAppointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL InjectionThe Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.58%7.2HighCVE-2024-10504reputeinfosystems · arforms +2 moreARForms Builder < 1.7.1 - Unauthenticated Stored XSSThe Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.EPSS0.34%6.3MediumCVE-2024-10681reputeinfosystems · armember – membership plugin, content restriction, member levels, user profile & user signup +1 moreARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionThe The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.0.51. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.EPSS0.37%9.3CriticalCVE-2024-49655reputeinfosystems · arprice +1 moreWordPress ARPrice plugin <= 4.1.3 - Unauthenticated SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.EPSS0.36%