plugin
11 known security issues reported for the Formassembly Web Forms WordPress plugin. Most recent disclosed Feb 18, 2025.
Running Formassembly Web Forms on your site? Check whether your installed version is affected.
Scan your site free[en] The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...
The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...
[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stored XSS.This issue affects WP-FormAssembly: from n/a through 2.0.10.
The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to injec...
The WP-FormAssembly plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.0.8 via the 'formassembly' shortcode. This can allow authenticated attackers with subscriber-level privileges or above to make web requests to arbitrary locations that include '/rest' in the path, o...
The WP-FormAssembly plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.0.8 via the 'formassembly' shortcode. This can allow authenticated attackers with subscriber-level privileges or above to make web requests to arbitrary locations that include '/rest' in the path, o...
Update the WordPress WP-FormAssembly plugin to the latest available version (at least 2.0.8). WordFence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP-FormAssembly Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other...
The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level an...
The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level an...
The WP-FormAssembly plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.0.5. This is due to insufficient controls on defining file paths on the fa_add() function. This makes it possible for contributor-level attackers to read the contents of any server file, including database...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free