Ws Form Pro Vulnerabilities

The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

7.2

Affected:

up to 1.10.13

Fixed in:

1.10.14

Disclosed:

Jan 27, 2025

CVE-2024-13509 on NVD →

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable config...

CVSS:

4.7

Affected:

up to 1.9.217

Fixed in:

1.9.218

Disclosed:

Jun 6, 2024

CVE-2023-5424 on NVD →

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

CVSS:

7.2

Affected:

up to 1.8.176

Fixed in:

1.8.176

Disclosed:

Jan 31, 2022

CVE-2022-23988 on NVD →

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS:

4.8

Affected:

up to 1.8.176

Fixed in:

1.8.176

Disclosed:

Jan 31, 2022

CVE-2022-23987 on NVD →