Easy Registration Forms Vulnerabilities

[en] The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level ca...

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Sep 23, 2023

CVE-2023-5134 on NVD →

The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabil...

CVSS:

4.3

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Sep 22, 2023

CVE-2023-5134 on NVD →

[en] The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Nov 19, 2021

CVE-2021-39353 on NVD →

The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.

CVSS:

8.8

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Nov 18, 2021

CVE-2021-39353 on NVD →

Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.

CVSS:

8.8

Affected:

up to 2.0.6

Fix:

No patched version reported

Disclosed:

Nov 20, 2020

CVE-2020-22275 on NVD →

[en] Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.

Affected:

up to 2.0.6

Fixed in:

2.0.6

Disclosed:

Nov 4, 2020

CVE-2020-22275 on NVD →