Non notée
CVE-2021-24164 In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to…
Description
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.4 | premières → < 3.4.34.1 | 3.4.34.1 |
Autres CVE de Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Les 9 CVE de Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress →
CVE-2022-2903
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could…
7.2
Élevée
CVE-2021-25066
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing…
Non notée
CVE-2021-25056
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high…
Non notée
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which…
Non notée