Extension WordPress
Vulnérabilités Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Cette page rassemble les failles publiées pour Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
19 fiches
Funnelforms Free <= 3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Funnelforms Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-3.8
Non indiqué
31/12/2025
Funnelforms Free <= 3.8 – Missing Authorization
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.8. This makes it possible for unauthenticated attackers to perform an unauthorized…
*-3.8
Non indiqué
25/12/2025
Funnelforms Free <= 3.7.5.1 – Authenticated (Contributor+) PHP Object Injection
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted…
*-3.7.5.1
Non indiqué
03/12/2024
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 – Missing Authorization to Unauthenticated Arbitrary Media Deletion
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action…
*-3.7.3.2
3.7.4.1
28/08/2024
Funnelforms Free <= 3.7.3.2 – Authenticated (Administrator+) Arbitrary File Deletion
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path…
*-3.7.3.2
3.7.4.1
27/08/2024
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 – Missing Authorization to Unauthenticated Arbitrary Media Upload
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in…
*-3.7.3.2
3.7.4.1
27/08/2024
Funnelforms Free <= 3.7.3.2 – Authenticated (Administrator+) Arbitrary File Upload
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with…
*-3.7.3.2
3.7.4.1
27/08/2024
Funnelforms Free <= 3.4 – Missing Authorization to Arbitrary Post Deletion
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Arbitrary Post Duplication
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Cross-Site Request Forgery to Arbitrary Post Duplication
The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Enable/Disable Dark Mode
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Category Deletion
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Post Modification
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Cross-Site Request Forgery to Arbitrary Post Deletion
The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to New Category Creation
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Test Email Sending
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.4 – Missing Authorization to Category Update
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with…
*-3.4
3.4.2
01/11/2023
Funnelforms Free <= 3.3.9 – Unauthenticated Stored Cross-Site Scripting
The Funnelforms Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission answers in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
[*, 3.4)
3.4
18/09/2023
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
3.2.9-3.3.8.4
3.3.8.5
18/07/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.