Doppler Form Vulnerabilities

The Doppler Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_extension() function in all versions up to, and including, 2.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install limited plug...

CVSS:

4.3

Affected:

up to 2.5.1

Fixed in:

2.6.0

Disclosed:

Oct 8, 2025

CVE-2025-9544 on NVD →

[en] Missing Authorization vulnerability in fromdoppler Doppler Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Doppler Forms: from n/a through 2.4.5.

Affected:

up to 2.4.5

Fix:

No patched version reported

Disclosed:

Apr 17, 2025

CVE-2025-32620 on NVD →

The Doppler Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.4.6

Fixed in:

2.4.7

Disclosed:

Apr 10, 2025

CVE-2025-32620 on NVD →

The Doppler Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged reques...

CVSS:

6.1

Affected:

up to 2.5.1

Fixed in:

2.6.0

Disclosed:

Apr 9, 2025

CVE-2025-32667 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in fromdoppler Doppler Forms allows Stored XSS. This issue affects Doppler Forms: from n/a through 2.4.5.

Affected:

up to 2.4.5

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32667 on NVD →

The Doppler Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 2.5.1

Fixed in:

2.6.0

Disclosed:

Apr 4, 2025

CVE-2025-32165 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fromdoppler Doppler Forms allows Stored XSS. This issue affects Doppler Forms: from n/a through 2.4.5.

Affected:

up to 2.4.5

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32165 on NVD →