Wow Company Wow Forms vulnerabilities

2 vulnerabilities

Known vulnerabilities in Wow Company Wow Forms, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.2CVE-2021-24628unknownwow forms – create any form with custom style+2
EPSS score
1.55%
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection8.8CVE-2017-20244wow-companywow_forms
EPSS score
0.27%
Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.