plugin
9 known security issues reported for the Contact Form Add WordPress plugin. Most recent disclosed Nov 7, 2023.
Running Contact Form Add on your site? Check whether your installed version is affected.
Scan your site free[en] Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
The Form Builder plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.9.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable config...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.
The Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.9.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site admin...
[en] The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
The Form Builder | Create Responsive Contact Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘form_id’ parameter in versions up to, and including, 1.9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
The Form Builder | Create Responsive Contact Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘form_id’ parameter in versions up to, and including, 1.9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
The plugin does not properly sanitise and escape its from_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free