Vfbpro Visual Form Builder vulnerabilities
5 vulnerabilities
Known vulnerabilities in Vfbpro Visual Form Builder, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-24514unknownvisual form builder+2
EPSS score0.62%
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowedCVE-2022-1046unknownvisual form builder+2EPSS score0.60%
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowedCVE-2022-0142unknownvisual form builder+2EPSS score2.87%
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.CVE-2022-0140unknownvisual form builder+2EPSS score3.84%
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.CVE-2022-0141unknownvisual form builder+2EPSS score0.47%
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks