IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
3.5Niedrig

CVE-2025-3514SureForms < 1.4.4 - Admin+ Stored XSS

SureForms Veröffentlicht: (vor 1 Jahr)

Beschreibung

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
brainstormforce sureforms < 1.4.4
— SureForms < 1.4.4

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:* < 1.4.4

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score
CVE-2026-110963

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Userplace

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or …

Ohne Score
CVE-2026-104639

Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Razorpay for WooCommerce

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…