Cformsii Project Cformsii — known CVE vulnerabilities

Every CVE whose affected-product data names Cformsii Project Cformsii, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2015-9333 — CVSS 9.8 (critical): The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
• CVE-2017-18570 — CVSS 9.8 (critical): The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
• CVE-2019-15238 — CVSS 8.8 (high): The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
• CVE-2017-18559 — CVSS 6.1 (medium): The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
• CVE-2014-10377 — CVSS 6.1 (medium): The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
• CVE-2014-10392 — CVSS 6.1 (medium): The cforms2 plugin before 10.2 for WordPress has XSS.
• CVE-2014-10393 — CVSS 6.1 (medium): The cforms2 plugin before 10.5 for WordPress has XSS.
• CVE-2023-52203 — CVSS 5.9 (medium): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann…
• CVE-2023-25449 — CVSS 4.3 (medium): Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.