Vulnerability history

Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification vulnerability

Reflected Cross-Site Scripting vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

Subscriber+ Subscription Cancellation via IDOR vulnerability

Form Manager+ Cross-Form Submission Entry Deletion via IDOR vulnerability

Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability

Reflected Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Sensitive Information Exposure vulnerability

Contributor+ Stored XSS vulnerability

Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation vulnerability

Authenticated (Subscriber+) Authorization Bypass vulnerability

Authenticated (Subscriber+) Authorization Bypass vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated (Administrator+) Arbitrary File Read vulnerability

WordPress Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Broken Access Control vulnerability

Arbitrary Shortcode Execution vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder vulnerability

Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id vulnerability

Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

IP-Spoofing vulnerability

Unauthenticated Stored Cross-Site Scripting via Form Subject vulnerability

Admin+ Stored XSS vulnerability

Authenticated (Form Manager+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

PHP Object Injection vulnerability

Missing Authorization to Settings Update and Limited Privilege Escalation vulnerability

Missing Authorization to Setting Manipulation vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title vulnerability

Broken Access Control vulnerability

SQL Injection vulnerability

Contributor+ Stored XSS via Custom HTML Form Field vulnerability

CSV Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS)