Formcraft3 Vulnerabilities

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

7.2

Affected:

up to 3.9.14

Fixed in:

3.9.15

Disclosed:

Jul 22, 2026

CVE-2026-7232 on NVD →

[en] The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may conta...

Affected:

up to 3.9.12

Fixed in:

3.9.12

Disclosed:

Feb 18, 2025

CVE-2024-13783 on NVD →

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wh...

CVSS:

7.2

Affected:

up to 3.9.11

Fixed in:

3.9.12

Disclosed:

Feb 17, 2025

CVE-2025-0817 on NVD →

The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain se...

CVSS:

4.3

Affected:

up to 3.9.11

Fixed in:

3.9.12

Disclosed:

Feb 17, 2025

CVE-2024-13783 on NVD →

[en] The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Affected:

up to 3.8.28

Fixed in:

3.8.28

Disclosed:

Mar 21, 2022

CVE-2022-0591 on NVD →

[en] The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Sep 10, 2019

CVE-2017-18600 on NVD →

The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.

CVSS:

5.4

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Jul 26, 2017

CVE-2017-18600 on NVD →

Authenticated Stored Cross-site scripting (XSS) vulnerability found by 8bitsec in WordPress FormCraft 3 premium plugin (alternative name - FormCraft Premium WordPress Form Builder). 2017.07.29 - we were unable to find any information about patched version of WordPress FormCraft 3 premium plugin.

Affected:

up to 3.2.32

Fixed in:

3.2.32

Disclosed:

Jul 25, 2017

Affected:

up to 3.9.12

Fixed in:

3.9.12

CVE-2025-0817 on NVD →