Extension WordPress
Vulnérabilités Caldera Forms – More Than Contact Forms
Cette page rassemble les failles publiées pour Caldera Forms – More Than Contact Forms, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Caldera Forms – More Than Contact Forms
6 fiches
Caldera Forms <= 1.9.6 – Reflected Cross-Site Scripting via cf-api
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
[*, 1.9.7)
1.9.7
28/03/2022
Caldera forms <= 1.9.4 – Admin+ Stored Cross-Site Scripting
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
[*, 1.9.5)
1.9.5
11/11/2021
Caldera Forms <= 1.5.9.1 – Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3)…
*-1.5.9.1
1.6.0
20/04/2018
Caldera Forms <= 1.5.4 – Cross-Site Scripting
The Caldera Forms plugin for WordPress is vulnerable to Cross-Site Scripting via the "edit" parameter in versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to…
*-1.5.4
1.5.5
08/09/2017
Caldera Forms <= 1.4.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting
The Caldera Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSRF through the ‘create_form’ action in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for…
*-1.4.1
1.4.2
08/11/2016
Caldera Forms – More Than Contact Forms < 1.4.0 – Sensitive Information Disclosure
The Caldera Forms – More Than Contact Forms plugin for WordPress is vulnerable to Sensitive Information Disclosure due to missing capability checks on the browse_entries() function that makes it possible for low-level authenticated attackers to retrieve form entries…
[*, 1.4.0)
1.4.0
24/05/2016
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.