7.2
High
CVE-2024-2082 The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored…
Description
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EleForms – All In One Form Integration including DB for Elementor 2.9 | earliest → 2.9.9.7 | No fix stated |
Other CVEs of EleForms – All In One Form Integration including DB for Elementor
The 4 CVEs of EleForms – All In One Form Integration including DB for Elementor →
CVE-2024-6628
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site…
4.3
Medium
CVE-2024-6626
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized…
5.3
Medium
CVE-2024-2043
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized…
5.3
Medium