plugin

Iats Online Forms Vulnerabilities

2 known security issues reported for the Iats Online Forms WordPress plugin. Most recent disclosed Aug 28, 2025.

1 critical 1 medium

Running Iats Online Forms on your site? Check whether your installed version is affected.

iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter

medium

The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

CVSS:: 6.5
Affected:: up to 1.2
Fix:: No patched version reported
Disclosed:: Aug 28, 2025

CVE-2025-9441 on NVD →

iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter

critical

Fix:: No patched version reported
Disclosed:: Aug 28, 2025

CVE-2025-9441 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database