Constant Contact Forms By Mailmunch Vulnerabilities

[en] The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Nov 13, 2024

CVE-2024-9614 on NVD →

The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Nov 12, 2024

CVE-2024-9614 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.

Affected:

up to 2.1.0

Fixed in:

2.1.0

Disclosed:

Jan 12, 2024

CVE-2024-22137 on NVD →

The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and ab...

CVSS:

6.4

Affected:

up to 2.0.11

Fixed in:

2.1.0

Disclosed:

Jan 10, 2024

CVE-2024-22137 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions.

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Oct 16, 2023

CVE-2023-45647 on NVD →

The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.10. This is due to missing nonce validation on several of the plugin's functions, such as delete_email(), delete_widget(), change_email_status(), and settings_page(). This makes...

CVSS:

4.3

Affected:

up to 2.0.10

Fixed in:

2.0.11

Disclosed:

Oct 12, 2023

CVE-2023-45647 on NVD →