Contact Form Generator Vulnerabilities

The Contact Form Generator plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, w...

CVSS:

8.8

Affected:

up to 2.7.1

Fixed in:

2.9.0

Disclosed:

Oct 9, 2023

CVE-2023-35911 on NVD →

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the id parameter in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...

CVSS:

6.1

Affected:

up to 2.5.5

Fixed in:

2.6.0

Disclosed:

Jul 17, 2023

CVE-2023-37988 on NVD →

The Contact Form Generator : Creative form builder for WordPress for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.86. This is due to missing or incorrect nonce validation on cfg_forms page. This makes it possible for unauthenticated attackers to modify and create contact f...

CVSS:

6.3

Affected:

up to 2.1.86

Fixed in:

2.5.0

Disclosed:

Sep 4, 2015

CVE-2015-6965 on NVD →