CVE-2024-13509

概要

参考情報

• plugins.trac.wordpress.org/changeset/3225862/ws-form · Patch
• plugins.trac.wordpress.org/changeset/3226595/ws-form · Patch
• wsform.com/changelog · Release Notes
• wordfence.com/threat-intel/vulnerabilities/id/910d9b31-b63a-427e-830b-a4c6a7e77ade · Third Party Advisory

ws form のその他の脆弱性

• CVE-2024-10647中 6.1The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t…
• CVE-2023-5424高 8.8The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated …
• CVE-2023-52135高 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Con…
• CVE-2022-23988中 6.1The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker …
• CVE-2022-23987中 4.8The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users…