Flexi Vulnerabilities

The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 4.28

Fix:

No patched version reported

Disclosed:

Oct 2, 2025

CVE-2025-9129 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit allows PHP Local File Inclusion. This issue affects Flexi – Guest Submit: from n/a through 4.28.

Affected:

up to 4.28

Fix:

No patched version reported

Disclosed:

Apr 11, 2025

CVE-2025-32589 on NVD →

The Flexi – Guest Submit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.28. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access...

CVSS:

9.8

Affected:

up to 4.28

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32589 on NVD →

[en] The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting

Affected:

up to 4.20

Fixed in:

4.20

Disclosed:

Mar 14, 2022

CVE-2022-0449 on NVD →

The Flexi - Guest Submit WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting.

CVSS:

6.1

Affected:

up to 4.20

Fixed in:

4.20

Disclosed:

Feb 16, 2022

CVE-2022-0449 on NVD →