{"error":0,"message":null,"data":{"name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","plugin":"fluentform","link":"https:\/\/wordpress.org\/plugins\/fluentform\/","latest":"1764835440","closed":0,"vulnerability":[{"uuid":"9ef8c15b518df8d8375cc26399ce0be0af06613798940d16945ae4a058040d25","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 3.6.67","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.6.67","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-34620","name":"CVE-2021-34620","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-34620","description":"[en] The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions","date":"2021-07-07"},{"id":"2c265955c101c5a638fe84a0b174d5b8a007a61e","name":"WordPress Contact Form Plugin by Fluent Forms <= 3.6.65 - Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-contact-form-plugin-by-fluent-forms-3-6-65-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss","description":"Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS) discovered by Ramuel Gall (WordFence) in WordPress Contact Form Plugin by Fluent Forms (versions <= 3.6.65).","date":"2021-06-16"},{"id":"a67d8bb06f06fd0475320d2236f16fdd49397e09","name":"WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/wp-fluent-forms-3667-stored-cross-site-scripting","description":"The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions","date":"2021-06-16"},{"id":"16070387-e2b2-4b97-8cd8-cc2db80a3995","name":"WP Fluent Forms < 3.6.67 - Cross-Site Request Forgery (CSRF)","link":"https:\/\/wpscan.com\/vulnerability\/16070387-e2b2-4b97-8cd8-cc2db80a3995","description":"The WP Fluent Forms WordPress plugin was vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability that could lead to Stored Cross-Site Scripting (XSS).","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"da42b1cc0835837f561a24d08bac15438f8756310f767c5ff1e4f34d80ec6b1a","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 4.3.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.3.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-3463","name":"CVE-2022-3463","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-3463","description":"[en] The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection","date":"2022-11-07"},{"id":"d1f1cc7d5244179f9854d89d56d94fe1b7313d5c","name":"WordPress FluentForm plugin <= 4.3.12 - CSV Injection vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-4-3-12-csv-injection-vulnerability","description":"CSV Injection vulnerability discovered by Francesco Carlucci in WordPress FluentForm plugin (versions <= 4.3.12).\nUpdate the WordPress Contact Form Plugin plugin to the latest available version (at least 4.3.13).","date":"2022-10-17"},{"id":"af0949f7437d0bb5f90954cad3e9cac9fc702f6f","name":"Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluentform-4312-csv-injection","description":"The Contact Form Plugin by FluentForm plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 4.3.12. This allows attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.","date":"2022-10-17"},{"id":"e2a59481-db45-4b8e-b17a-447303469364","name":"FluentForm < 4.3.13 - CSV Injection","link":"https:\/\/wpscan.com\/vulnerability\/e2a59481-db45-4b8e-b17a-447303469364","description":"The plugin does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection","date":null}],"impact":{"cwe":[{"cwe":"CWE-1236","name":"Improper Neutralization of Formula Elements in a CSV File","description":"The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product."}]}},{"uuid":"823002a5e87f23abb5ad2f559afeb9ad4a5f6a505c3b92320175a0b0cfc25723","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 4.3.25","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.3.25","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-0546","name":"CVE-2023-0546","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-0546","description":"[en] The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.","date":"2023-04-10"},{"id":"369a482dfcdfc59bda3f9d9aae90917b8dbd022f","name":"WordPress FluentForm Plugin < 4.3.25 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-4-3-25-contributor-stored-xss-via-custom-html-form-field-vulnerability","description":"Update the WordPress FluentForm plugin to the latest available version (at least 4.3.25).\nVaibhav Rajput discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress FluentForm Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.3.25.","date":"2023-04-11"},{"id":"257e17e80db1283d78aa3cefadfdde66ad48fe57","name":"FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentforms-4324-authenticatedcontributor-stored-cross-site-scripting","description":"The FluentForms plugin for WrodPress is vulnerable to stored Cross-Site Scripting via custom form fields in versions up to, and including, 4.3.24. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-03-20"},{"id":"078f33cd-0f5c-46fe-b858-2107a09c6b69","name":"FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field","link":"https:\/\/wpscan.com\/vulnerability\/078f33cd-0f5c-46fe-b858-2107a09c6b69","description":"The plugin does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"cad82c6cbed306beb909d2e3006d7e7fa6cd43fce8bce58d8bd9535513a9101e","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-24410","name":"CVE-2023-24410","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-24410","description":"[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin \u2013 Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin \u2013 Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n\/a through 4.3.25.","date":"2023-10-31"},{"id":"a8c1c0daaec50e22bfbcf247236855b28dcbe99e","name":"WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-4-3-25-sql-injection-vulnerability","description":"Update the WordPress FluentForm plugin to the latest available version (at least 5.0.0).\nRavi Dharmawan discovered and reported this SQL Injection vulnerability in WordPress FluentForm Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 5.0.0.","date":"2023-07-12"},{"id":"b11b076e9e29fc2e79ae8499558dfdfe9209bfe2","name":"FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-4325-authenticated-administrator-sql-injection","description":"The FluentForm plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.3.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2023-07-12"},{"id":"6e87badd-eccb-4c1d-9662-21ae5f76097a","name":"FluentForm < 5.0.0 - SQL Injection","link":"https:\/\/wpscan.com\/vulnerability\/6e87badd-eccb-4c1d-9662-21ae5f76097a","description":"The plugin does not properly neutralize special elements used in an SQL command, resulting in a SQL Injection vulnerability.","date":null}],"impact":{"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}]}},{"uuid":"6f66614450f14e2dfc5a171733600b0ea64da651a80b2606ffee7d76896a1434","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.0.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"701b208668bba1168289bdd44ec221a9534e4139","name":"Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-for-plugin-by-fluent-forms-508-insecure-direct-object-reference","description":"The Contact Form for Plugin by Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.8 via the addIsRenderableFilter() function due to missing validation on the publication status of a form. This makes it possible for users to render and submit forms when the form is in an 'unpublished' state.","date":"2023-09-08"}],"impact":[]},{"uuid":"330ec6c964da9b7d24ed1f27a0251e8d9956f6a30b2ef7f1afa3c7bae18176e3","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.0.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-41952","name":"CVE-2023-41952","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-41952","description":"[en] Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n\/a through 5.0.8.","date":"2024-12-13"},{"id":"dbc1f379c1e122ebbf1d4323942ffb144c99482c","name":"WordPress FluentForm Plugin <= 5.0.8 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluent-forms-plugin-5-0-8-broken-access-control-vulnerability","description":"Update the WordPress FluentForm plugin to the latest available version (at least 5.0.9).\nRevan Arifio discovered and reported this Broken Access Control vulnerability in WordPress FluentForm Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 5.0.9.","date":"2023-09-11"},{"id":"dbce5fb4-9abf-4351-a9ae-01d304eb2e6c","name":"Contact Form for Plugin by Fluent Forms < 5.0.9 - Insecure Direct Object Reference","link":"https:\/\/wpscan.com\/vulnerability\/dbce5fb4-9abf-4351-a9ae-01d304eb2e6c","description":"The Contact Form for Plugin by Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.8 via the addIsRenderableFilter() function due to missing validation on the publication status of a form. This makes it possible for users to render and submit forms when the form is in an 'unpublished' state.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"09d1d3ff2cab39824e963ee8c16a69e2fb7d4da36b02a0c45699c9e8c729b7a1","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"0f6861446c277a04144a0e51db77ed243169ea8b","name":"Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-515-authenticatedadministrator-stored-cross-site-scripting-via-imported-form-title","description":"The Contact Form Plugin \u2013 Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-01-18"}],"impact":[]},{"uuid":"fa1e9b1ee4a8dc8afd708141cbfa23287f636f300c3d92accf6030e0e7787a68","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d39ecd41838bd4342b518d71ab8880e39b07bf8c","name":"WordPress FluentForm Plugin <= 5.1.5 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluent-forms-plugin-5-1-5-authenticated-administrator-stored-cross-site-scripting-via-imported-form-title-vulnerability","description":"Update the WordPress FluentForm plugin to the latest available version (at least 5.1.7).\nAkbar Kustirama discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress FluentForm Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 5.1.7.\nHave additional information or questions about this entry? Get in touch.","date":"2024-01-19"}],"impact":[]},{"uuid":"34c833b321c5b237b874aac2c4a7d7d968bf68da64fd194fc6006446b6c83386","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-0618","name":"CVE-2024-0618","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-0618","description":"[en] The Contact Form Plugin \u2013 Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-01-27"},{"id":"a7d5f658-e733-46dd-b98b-c9d956c9d189","name":"Fluent Forms < 5.1.7 - Admin+ Stored Cross-Site Scripting via imported form title","link":"https:\/\/wpscan.com\/vulnerability\/a7d5f658-e733-46dd-b98b-c9d956c9d189","description":"The plugin is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."}]}},{"uuid":"c32133f8286e4e0a424f8f9ebf9257efe847f43fa8341cb45fdbe5a10d100605","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-6957","name":"CVE-2023-6957","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-6957","description":"[en] The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.","date":"2024-03-13"},{"id":"ff6e85fbf2382aec0aaee9e5216203483583c76b","name":"Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-519-authenticated-contributor-stored-cross-site-scripting","description":"The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.","date":"2024-03-05"},{"id":"256417a1a3d92aa9080502ab5cd34d54074bf2d4","name":"WordPress FluentForm Plugin <= 5.1.9 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluent-forms-plugin-5-1-9-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"Update the WordPress FluentForm plugin to the latest available version (at least 5.1.10).\ndrop discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress FluentForm Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 5.1.10.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"fd832858-a1e3-46f0-aae0-c926fde56c87","name":"Fluent Forms < 5.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/fd832858-a1e3-46f0-aae0-c926fde56c87","description":"The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"6bb8bfd6b425eb2c391d28bd4a6fb2d2559b5cafcd1c996c1dd964a8eed278b2","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2782","name":"CVE-2024-2782","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2782","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \/wp-json\/fluentform\/v1\/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.","date":"2024-05-18"},{"id":"16fe0c41b9e9c6bf05bb90640afe0d4d7885c463","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5116-missing-authorization-to-setting-manipulation","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \/wp-json\/fluentform\/v1\/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.","date":"2024-05-17"},{"id":"6b3b97f058bfb6c0acca4fc59bad38b1d973d229","name":"WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-16-missing-authorization-to-setting-manipulation-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Broken Access Control<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.16<\/p>

Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"9da30c9b9cc1e4bed0580ee400b5880506f0cdc740ab7b050012e493215ed24b","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2771","name":"CVE-2024-2771","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2771","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the \/wp-json\/fluentform\/v1\/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.","date":"2024-05-18"},{"id":"83e2ee42636cda5f9393b2cc6f6f4774770e3543","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5116-missing-authorization-to-settings-update-and-limited-privilege-escalation","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the \/wp-json\/fluentform\/v1\/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.","date":"2024-05-17"},{"id":"c272e70ca955701ab1d0d8c9540fa69694f662e9","name":"WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Privilege Escalation","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-16-missing-authorization-to-settings-update-and-limited-privilege-escalation-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Privilege Escalation<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.16<\/p>

Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"384a44fdeeea5b7c3c2404594fb0cc51109426562c5d68f784d1b689b85d2639","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.14","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.14","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2772","name":"CVE-2024-2772","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2772","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.","date":"2024-05-18"},{"id":"7818142400cb822bf06e9b5a7bd4f42655f40e82","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5113-authenticated-subscriber-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.","date":"2024-05-17"},{"id":"c527a64e7ad015ef8bac9e3a13a4643f72615739","name":"WordPress FluentForm Plugin <= 5.1.13 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-13-authenticated-subscriber-stored-cross-site-scripting-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.13 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.13<\/p>

Fixed in version 5.1.14 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"6b25dba878e08edb26126080887931f2295a79ccd6261a616ee48ada287c5336","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4709","name":"CVE-2024-4709","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4709","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018subject\u2019 parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-18"},{"id":"e9264c77f1223c3ba5227d78667dc1b506064d82","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5116-authenticated-contributor-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018subject\u2019 parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-17"},{"id":"9840eff5972c209ee85e89a796b3160f403d6db8","name":"WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-16-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.16<\/p>

Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"5858f46b262a2d596f36d3a0e88bdd55adb993a9bd616099e6cd568e1e30b0cd","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.16","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.16","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4157","name":"CVE-2024-4157","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4157","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have \"View Form\" and \"Manage Form\" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.","date":"2024-05-22"},{"id":"2096342e5b4530de7807af7f078e708cccdb1e68","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5115-php-object-injection-via-extractdynamicvalues","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have \"View Form\" and \"Manage Form\" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.","date":"2024-05-21"},{"id":"f7ba1bf2ededac48ff6a10df704960a7c5b5383c","name":"WordPress FluentForm Plugin <= 5.1.15 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-15-php-object-injection-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.15 is vulnerable to PHP Object Injection<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.15<\/p>

Fixed in version 5.1.16 <\/p>","date":"2024-05-23"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}]}},{"uuid":"cbbdde7bc5276bc717eabc9e36002a15ad8bd484cbd939b04689fa1f1b0af3a3","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6520","name":"CVE-2024-6520","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6520","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"bf41dc8756ae4f71dcd6d87d5a2f2215a45febe4","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting-2","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"},{"id":"62f1f991d02d750826ce9eb8388a18a1526c1378","name":"WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-19-authenticated-administrator-stored-cross-site-scripting-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.19<\/p>

Fixed in version 5.1.20 <\/p>","date":"2024-07-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"35ea571074caf9f5b391520d87e30f940f922101e9225a54728786cc56f28a47","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6703","name":"CVE-2024-6703","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6703","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018description\u2019 and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"729dd05cf69ccfe0f56b6d3bbcba44237d910fc9","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5119-authenticated-subscriber-stored-cross-site-scripting-via-welcome-screen-fields","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018description\u2019 and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"b7332fd2da1cba28d9b90b2bcab07fedd56a01bb417949c8e6e847fce98389ad","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6518","name":"CVE-2024-6518","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6518","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"99ec570f35033487376aa11cfbf1b1245a265e64","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting-1","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"84ecb4bfabbfcc8aa2b5841e35fbe4c910de0dd04857d4c63f413aa42aa4e569","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6521","name":"CVE-2024-6521","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6521","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"dfe85172f0c398484ed6f4399cf2c330916d964e","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"5ef1e61e9a2300fc19542a790ce042fc8d3e2763e0faf12f5c1d4a342716ade7","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.19","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.19","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-5053","name":"CVE-2024-5053","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5053","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.","date":"2024-09-01"},{"id":"52e4b43c82acc81f985b852a779f6317707d020b","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5118-subscriber-improper-authorization-leading-to-unauthorized-mailchimp-integration-modification","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.","date":"2024-08-31"},{"id":"f95c6231eb23aba6c6d9f30bd212c37c125dcfc9","name":"WordPress FluentForm Plugin <= 5.1.18 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-18-missing-authorization-to-authenticated-subscriber-mailchimp-integration-modification-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.18 is vulnerable to Broken Access Control<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.18<\/p>

Fixed in version 5.1.19 <\/p>","date":"2024-09-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"n","score":"4.2","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-285","name":"Improper Authorization","description":"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"a3754201b3ffeb7eeb255727c4bb69f1d60c1321e20ec8daff1daeb07fdefec9","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9528","name":"CVE-2024-9528","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9528","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-10-05"},{"id":"f6bf1c08dcd3f2d2ad08f8dc7dd2df693a0eae26","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5119-authenticated-form-manager-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-10-04"},{"id":"ebe58c380bde5bf8a749f2dd942ead060ee7a2b2","name":"WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-19-authenticated-form-manager-stored-cross-site-scripting-vulnerability","description":"

WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: FluentForm<\/p>

Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>

Affected Version <= 5.1.19<\/p>

Fixed in version 5.1.20 <\/p>","date":"2024-10-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"9d6be5aee62d6f7e2e19567d89fe04243fb6adebd3bf8da0cfbabae1e7f9b623","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9651","name":"CVE-2024-9651","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9651","description":"[en] The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2024-12-09"},{"id":"8a6c9ce4374f07f324b0fbf324487694cffc2e44","name":"Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-520-authenticated-admin-stored-cross-site-scripting","description":"The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-11-18"},{"id":"fc4fdbb63a8ca6f24fdeda122cd5cfee1e8a7f8a","name":"WordPress FluentForm Plugin < 5.2.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluent-forms-plugin-5-2-1-admin-stored-xss-vulnerability","description":"

WordPress FluentForm Plugin < 5.2.1 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: FluentForm<\/p>

Fixed in version 5.2.1 <\/p>

Affected Version < 5.2.1<\/p>

CVE: CVE-2024-9651<\/p>","date":"2024-12-09"}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"a2d7973850d49ba1bcb7022c0d95f36504f297b1f9c40f0a3d1b116ea5bc75eb","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.2.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10646","name":"CVE-2024-10646","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10646","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-12-14"},{"id":"b34e66e7923a67472884b5b95e419530e66974b2","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-526-unauthenticated-stored-cross-site-scripting-via-form-subject","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-12-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"40cf293e5617c0e9aa547bcb8396d816c6610800979e66df85d3b6f13fab55dc","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13666","name":"CVE-2024-13666","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13666","description":"[en] The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":"2025-03-22"},{"id":"be38c04ee37813e3292c0ef7b4121c813e1d2555","name":"Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-customizable-contact-forms-survey-quiz-conversational-form-builder-5212-ip-spoofing","description":"The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":null},{"id":"EUVD-2025-7183","name":"EUVD-2025-7183","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-7183","description":"The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":"2025-03-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly."}]}},{"uuid":"19bb1782dd018c3b9be15836f2a420d86861efc7a7af066df734a49bb428c655","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.0.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.0.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-3615","name":"CVE-2025-3615","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-3615","description":"","date":null},{"id":"cd1e5a3b3da4536da71ea8a5996368f3108680ca","name":"Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-602-authenticated-contributor-stored-cross-site-scripting","description":"The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":null},{"id":"EUVD-2025-11513","name":"EUVD-2025-11513","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-11513","description":"The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-04-17"}],"impact":[]},{"uuid":"f2644b161c4fb30cbc70c2bb202383c0fea72daf980ea41197c948d9d84bc9d9","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.1.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.1.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-13748","name":"CVE-2025-13748","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-13748","description":"[en] The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.","date":"2025-12-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data."}]}}]},"updated":"1765187829"}