OUR
SERVICES
Business services is a general term that describes work that supports a business but does not produce a tangible commodity. Describes work that supports a business but does not produce a tangible commodity.
Networking Service
Fixed line connectivity
Internal Controls
Safeguards assets
Financial Service
Accounting functions
Online Purchasing
E-commerce ordering
START A NEW BRAND BUSINESS
HOW IT WORKS?
Creative Idea
Business services is a general term that describes work that supports a business but does not produce a tangible commodity.
Start Designing
Business services is a general term that describes work that supports a business but does not produce a tangible commodity.
Development
Business services is a general term that describes work that supports a business but does not produce a tangible commodity.
Looking for a Free Business Consultation?
Business services is a general term that describes work in corporation
ABOUT OUR
CORPORATION
Business services is a general term that describes work that supports a business but does not produce a tangible commodity.
SEE WHAT WE OFFER
OUR POPULAR SERVICES
WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Broken Access Control<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.16<\/p>
Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"9da30c9b9cc1e4bed0580ee400b5880506f0cdc740ab7b050012e493215ed24b","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2771","name":"CVE-2024-2771","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2771","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the \/wp-json\/fluentform\/v1\/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.","date":"2024-05-18"},{"id":"83e2ee42636cda5f9393b2cc6f6f4774770e3543","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5116-missing-authorization-to-settings-update-and-limited-privilege-escalation","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the \/wp-json\/fluentform\/v1\/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.","date":"2024-05-17"},{"id":"c272e70ca955701ab1d0d8c9540fa69694f662e9","name":"WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Privilege Escalation","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-16-missing-authorization-to-settings-update-and-limited-privilege-escalation-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Privilege Escalation<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.16<\/p>
Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"384a44fdeeea5b7c3c2404594fb0cc51109426562c5d68f784d1b689b85d2639","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.14","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.14","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2772","name":"CVE-2024-2772","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2772","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.","date":"2024-05-18"},{"id":"7818142400cb822bf06e9b5a7bd4f42655f40e82","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5113-authenticated-subscriber-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.","date":"2024-05-17"},{"id":"c527a64e7ad015ef8bac9e3a13a4643f72615739","name":"WordPress FluentForm Plugin <= 5.1.13 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-13-authenticated-subscriber-stored-cross-site-scripting-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.13 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.13<\/p>
Fixed in version 5.1.14 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"6b25dba878e08edb26126080887931f2295a79ccd6261a616ee48ada287c5336","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4709","name":"CVE-2024-4709","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4709","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018subject\u2019 parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-18"},{"id":"e9264c77f1223c3ba5227d78667dc1b506064d82","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5116-authenticated-contributor-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018subject\u2019 parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-17"},{"id":"9840eff5972c209ee85e89a796b3160f403d6db8","name":"WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-16-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.16 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.16<\/p>
Fixed in version 5.1.17 <\/p>","date":"2024-05-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"5858f46b262a2d596f36d3a0e88bdd55adb993a9bd616099e6cd568e1e30b0cd","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.16","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.16","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4157","name":"CVE-2024-4157","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4157","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have \"View Form\" and \"Manage Form\" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.","date":"2024-05-22"},{"id":"2096342e5b4530de7807af7f078e708cccdb1e68","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5115-php-object-injection-via-extractdynamicvalues","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have \"View Form\" and \"Manage Form\" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.","date":"2024-05-21"},{"id":"f7ba1bf2ededac48ff6a10df704960a7c5b5383c","name":"WordPress FluentForm Plugin <= 5.1.15 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-15-php-object-injection-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.15 is vulnerable to PHP Object Injection<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.15<\/p>
Fixed in version 5.1.16 <\/p>","date":"2024-05-23"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}]}},{"uuid":"cbbdde7bc5276bc717eabc9e36002a15ad8bd484cbd939b04689fa1f1b0af3a3","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6520","name":"CVE-2024-6520","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6520","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"bf41dc8756ae4f71dcd6d87d5a2f2215a45febe4","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting-2","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"},{"id":"62f1f991d02d750826ce9eb8388a18a1526c1378","name":"WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-19-authenticated-administrator-stored-cross-site-scripting-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.19<\/p>
Fixed in version 5.1.20 <\/p>","date":"2024-07-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"35ea571074caf9f5b391520d87e30f940f922101e9225a54728786cc56f28a47","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6703","name":"CVE-2024-6703","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6703","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018description\u2019 and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"729dd05cf69ccfe0f56b6d3bbcba44237d910fc9","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5119-authenticated-subscriber-stored-cross-site-scripting-via-welcome-screen-fields","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018description\u2019 and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"b7332fd2da1cba28d9b90b2bcab07fedd56a01bb417949c8e6e847fce98389ad","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6518","name":"CVE-2024-6518","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6518","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"99ec570f35033487376aa11cfbf1b1245a265e64","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting-1","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"84ecb4bfabbfcc8aa2b5841e35fbe4c910de0dd04857d4c63f413aa42aa4e569","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6521","name":"CVE-2024-6521","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6521","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-27"},{"id":"dfe85172f0c398484ed6f4399cf2c330916d964e","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluentform-5119-authenticated-administrator-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"5ef1e61e9a2300fc19542a790ce042fc8d3e2763e0faf12f5c1d4a342716ade7","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 5.1.19","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.19","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-5053","name":"CVE-2024-5053","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5053","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.","date":"2024-09-01"},{"id":"52e4b43c82acc81f985b852a779f6317707d020b","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5118-subscriber-improper-authorization-leading-to-unauthorized-mailchimp-integration-modification","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.","date":"2024-08-31"},{"id":"f95c6231eb23aba6c6d9f30bd212c37c125dcfc9","name":"WordPress FluentForm Plugin <= 5.1.18 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-18-missing-authorization-to-authenticated-subscriber-mailchimp-integration-modification-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.18 is vulnerable to Broken Access Control<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.18<\/p>
Fixed in version 5.1.19 <\/p>","date":"2024-09-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"n","score":"4.2","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-285","name":"Improper Authorization","description":"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"a3754201b3ffeb7eeb255727c4bb69f1d60c1321e20ec8daff1daeb07fdefec9","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.1.20","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.20","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9528","name":"CVE-2024-9528","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9528","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-10-05"},{"id":"f6bf1c08dcd3f2d2ad08f8dc7dd2df693a0eae26","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-5119-authenticated-form-manager-stored-cross-site-scripting","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-10-04"},{"id":"ebe58c380bde5bf8a749f2dd942ead060ee7a2b2","name":"WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluentform-plugin-5-1-19-authenticated-form-manager-stored-cross-site-scripting-vulnerability","description":"
WordPress FluentForm Plugin <= 5.1.19 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: FluentForm<\/p>
Link: https:\/\/wordpress.org\/plugins\/fluentform\/#developers<\/p>
Affected Version <= 5.1.19<\/p>
Fixed in version 5.1.20 <\/p>","date":"2024-10-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"h","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"9d6be5aee62d6f7e2e19567d89fe04243fb6adebd3bf8da0cfbabae1e7f9b623","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9651","name":"CVE-2024-9651","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9651","description":"[en] The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2024-12-09"},{"id":"8a6c9ce4374f07f324b0fbf324487694cffc2e44","name":"Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-520-authenticated-admin-stored-cross-site-scripting","description":"The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-11-18"},{"id":"fc4fdbb63a8ca6f24fdeda122cd5cfee1e8a7f8a","name":"WordPress FluentForm Plugin < 5.2.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/fluentform\/vulnerability\/wordpress-fluent-forms-plugin-5-2-1-admin-stored-xss-vulnerability","description":"
WordPress FluentForm Plugin < 5.2.1 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: FluentForm<\/p>
Fixed in version 5.2.1 <\/p>
Affected Version < 5.2.1<\/p>
CVE: CVE-2024-9651<\/p>","date":"2024-12-09"}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"a2d7973850d49ba1bcb7022c0d95f36504f297b1f9c40f0a3d1b116ea5bc75eb","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 5.2.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10646","name":"CVE-2024-10646","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10646","description":"[en] The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-12-14"},{"id":"b34e66e7923a67472884b5b95e419530e66974b2","name":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/contact-form-plugin-by-fluent-forms-for-quiz-survey-and-drag-drop-wp-form-builder-526-unauthenticated-stored-cross-site-scripting-via-form-subject","description":"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-12-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"40cf293e5617c0e9aa547bcb8396d816c6610800979e66df85d3b6f13fab55dc","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13666","name":"CVE-2024-13666","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13666","description":"[en] The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":"2025-03-22"},{"id":"be38c04ee37813e3292c0ef7b4121c813e1d2555","name":"Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-customizable-contact-forms-survey-quiz-conversational-form-builder-5212-ip-spoofing","description":"The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":null},{"id":"EUVD-2025-7183","name":"EUVD-2025-7183","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-7183","description":"The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.","date":"2025-03-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly."}]}},{"uuid":"19bb1782dd018c3b9be15836f2a420d86861efc7a7af066df734a49bb428c655","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.0.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.0.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-3615","name":"CVE-2025-3615","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-3615","description":"","date":null},{"id":"cd1e5a3b3da4536da71ea8a5996368f3108680ca","name":"Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/fluentform\/fluent-forms-602-authenticated-contributor-stored-cross-site-scripting","description":"The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":null},{"id":"EUVD-2025-11513","name":"EUVD-2025-11513","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-11513","description":"The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-04-17"}],"impact":[]},{"uuid":"f2644b161c4fb30cbc70c2bb202383c0fea72daf980ea41197c948d9d84bc9d9","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.1.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.1.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-13748","name":"CVE-2025-13748","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-13748","description":"[en] The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.","date":"2025-12-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data."}]}}]},"updated":"1765187829"}
WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Settings Change<\/p>
Affected Version <= 2.5.3<\/p>","date":"2024-04-17"},{"id":"82f3c336912e0536f326e99851032ec403642a6e","name":"LoginPress Pro < 3.0 - Missing Authorization to License Status Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-253-missing-authorization-to-license-status-update","description":"The LoginPress Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, but not including, 3.0. This makes it possible for unauthenticated attacks to activate and deactivate licenses.","date":"2024-04-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"6.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"d2252bc66191ccb4511e87df362f7498ce32966c533956e3d5e77abf7282a52e","name":"LoginPress Pro [loginpress-pro] < 3.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-32676","name":"CVE-2024-32676","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-32676","description":"[en] Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n\/a before 3.0.0.","date":"2024-04-25"},{"id":"32a9f2b753d1f06f0314ab6794e25629e007d379","name":"WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Bypass Vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/loginpress-pro\/vulnerability\/wordpress-loginpress-pro-plugin-2-5-3-captcha-bypass-vulnerability","description":"
WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Bypass Vulnerability<\/p>
Affected Version <= 2.5.3<\/p>","date":"2024-04-17"},{"id":"7e143d0c37578222f16ff582e4e556b1983ece26","name":"LoginPress Pro < 3.0 - Captcha Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-253-captcha-bypass","description":"The LoginPress Pro plugin for WordPress is vulnerable to Captcha Bypass in versions up to, but not including, 3.0. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.","date":"2024-04-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-307","name":"Improper Restriction of Excessive Authentication Attempts","description":"The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame."}]}},{"uuid":"867630e9325bae558163b77556cd81a52d837fcace2b6be4a924671b46711884","name":"LoginPress Pro [loginpress-pro] < 5.0.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-7444","name":"CVE-2025-7444","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-7444","description":"","date":null},{"id":"f016a9818be5d37890b61526e26c5679874c5507","name":"WordPress LoginPress Pro Plugin <= 5.0.1 is vulnerable to Broken Authentication","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/loginpress-pro\/vulnerability\/wordpress-loginpress-pro-plugin-5-0-1-authentication-bypass-via-wordpress-com-oauth-provider-vulnerability","description":"
WordPress LoginPress Pro Plugin <= 5.0.1 is vulnerable to Broken Authentication<\/p>
Software: LoginPress Pro<\/p>
Fixed in version 5.0.2 <\/p>
Affected Version <= 5.0.1<\/p>
CVE: CVE-2025-7444<\/p>","date":"2025-07-18"},{"id":"b048f63e4e704205394283b4fcb2da2416e2846f","name":"LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-501-authentication-bypass-via-wordpresscom-oauth-provider","description":"The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.","date":null}],"impact":[]}]},"updated":"1752828905"}
WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Settings Change
Affected Version <= 2.5.3","date":"2024-04-17"},{"id":"82f3c336912e0536f326e99851032ec403642a6e","name":"LoginPress Pro < 3.0 - Missing Authorization to License Status Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-253-missing-authorization-to-license-status-update","description":"The LoginPress Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, but not including, 3.0. This makes it possible for unauthenticated attacks to activate and deactivate licenses.","date":"2024-04-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"6.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"d2252bc66191ccb4511e87df362f7498ce32966c533956e3d5e77abf7282a52e","name":"LoginPress Pro [loginpress-pro] < 3.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-32676","name":"CVE-2024-32676","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-32676","description":"[en] Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n\/a before 3.0.0.","date":"2024-04-25"},{"id":"32a9f2b753d1f06f0314ab6794e25629e007d379","name":"WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Bypass Vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/loginpress-pro\/vulnerability\/wordpress-loginpress-pro-plugin-2-5-3-captcha-bypass-vulnerability","description":"
WordPress LoginPress Pro Plugin <= 2.5.3 is vulnerable to Bypass Vulnerability
Affected Version <= 2.5.3","date":"2024-04-17"},{"id":"7e143d0c37578222f16ff582e4e556b1983ece26","name":"LoginPress Pro < 3.0 - Captcha Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-253-captcha-bypass","description":"The LoginPress Pro plugin for WordPress is vulnerable to Captcha Bypass in versions up to, but not including, 3.0. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.","date":"2024-04-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-307","name":"Improper Restriction of Excessive Authentication Attempts","description":"The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame."}]}},{"uuid":"867630e9325bae558163b77556cd81a52d837fcace2b6be4a924671b46711884","name":"LoginPress Pro [loginpress-pro] < 5.0.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-7444","name":"CVE-2025-7444","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-7444","description":"","date":null},{"id":"f016a9818be5d37890b61526e26c5679874c5507","name":"WordPress LoginPress Pro Plugin <= 5.0.1 is vulnerable to Broken Authentication","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/loginpress-pro\/vulnerability\/wordpress-loginpress-pro-plugin-5-0-1-authentication-bypass-via-wordpress-com-oauth-provider-vulnerability","description":"
WordPress LoginPress Pro Plugin <= 5.0.1 is vulnerable to Broken Authentication
Software: LoginPress Pro
Fixed in version 5.0.2
Affected Version <= 5.0.1
CVE: CVE-2025-7444","date":"2025-07-18"},{"id":"b048f63e4e704205394283b4fcb2da2416e2846f","name":"LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loginpress-pro\/loginpress-pro-501-authentication-bypass-via-wordpresscom-oauth-provider","description":"The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.","date":null}],"impact":[]}]},"updated":"1752828905"}
