Unknown Contact Form & Lead Form Elementor Builder vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Contact Form & Lead Form Elementor Builder, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2021-24967themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted LeadsEPSS1.19%MediumCVE-2022-23179themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site ScriptingThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowedEPSS0.54%MediumCVE-2022-23180themehunk · contact_form_\&_lead_form_elementor_builder +2 moreContact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings UpdateThe Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settingsEPSS0.53%