Liveforms Vulnerabilities

The Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform a...

CVSS:

4.3

Affected:

up to 4.8.4

Fixed in:

4.8.5

Disclosed:

Apr 16, 2025

CVE-2025-39560 on NVD →

[en] Missing Authorization vulnerability in Shahjada Live Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Live Forms: from n/a through 4.8.4.

Affected:

up to 4.8.5

Fixed in:

4.8.5

Disclosed:

Apr 16, 2025

CVE-2025-39560 on NVD →

[en] Missing Authorization vulnerability in Shahjada Live Forms. This issue affects Live Forms: from n/a through 4.8.5.

Affected:

up to 4.8.5

Fix:

No patched version reported

Disclosed:

Apr 8, 2025

CVE-2025-32279 on NVD →

The Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.8.5

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32279 on NVD →

The Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveSettings() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Subscriber-level...

CVSS:

5.3

Affected:

up to 4.8.4

Fixed in:

4.8.5

Disclosed:

Mar 27, 2025

CVE-2025-30809 on NVD →

[en] Missing Authorization vulnerability in Shahjada Live Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Live Forms: from n/a through 4.8.4.

Affected:

up to 4.8.5

Fixed in:

4.8.5

Disclosed:

Mar 27, 2025

CVE-2025-30809 on NVD →

[en] The liveforms plugin before 3.4.0 for WordPress has XSS.

Affected:

up to 3.4.0

Fixed in:

3.4.0

Disclosed:

Aug 13, 2019

CVE-2017-18497 on NVD →

[en] The liveforms plugin before 3.2.0 for WordPress has SQL injection.

Affected:

up to 3.2.0

Fixed in:

3.2.0

Disclosed:

Aug 13, 2019

CVE-2015-9301 on NVD →

The liveforms plugin before 3.4.0 for WordPress has XSS via several parameters.

CVSS:

6.1

Affected:

up to 3.4.0

Fixed in:

3.4.0

Disclosed:

Aug 21, 2017

CVE-2017-18497 on NVD →

The WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'status', 'query_status' and 'form_id' parameters in versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient pre...

CVSS:

9.8

Affected:

up to 3.2.0

Fixed in:

3.2.0

Disclosed:

Mar 11, 2015

CVE-2015-9301 on NVD →

This plugin is prone to a cross site scripting vulnerability, because form input fields on blog front-end are not filtered. The attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

Dec 19, 2014

Form input fields on the blog front end are not properly sanitised. The unsanitised user input will be displayed in "WordPress Admin > Form entries". Screenshots: http://imgur.com/Oflsb3n http://imgur.com/jHaZR5O

Affected:

up to 1.3.0

Fixed in:

1.3.0