Web Dorado Contact Form Maker vulnerabilities

4 vulnerabilities

Known vulnerabilities in Web Dorado Contact Form Maker, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1CVE-2018-25347web-doradocontact_form_maker
EPSS score
0.21%
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.9.8CVE-2015-2798web-doradocontact_form_maker
EPSS score
3.26%
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.5.1CVE-2019-25734web-doradocontact_form_maker
EPSS score
0.89%
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.7.2CVE-2023-2655unknowncontact form by wd+2
EPSS score
0.93%
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin