WordPress Plugin Vulnerabilities

JetFormBuilder < 3.1.5 - Unauthenticated Content Injection

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to content injection in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to inject content onto the site.

Affects Plugins

Plugin icon
jetformbuilder
Fixed in 3.1.5

References

CVE
CVE-2023-48763
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f0343861-a376-43ea-826e-277c2a5ea635

Miscellaneous

Original Researcher
Revan Arifio
Verified
Yes
WPVDB ID
c4f657da-662d-45e1-8d8d-bbb56ae19d36

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-07 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Awake 3.3 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2014-10-02
Title
Enfold < 3.0.1 - Unspecified Issue
Published
2023-11-23
Title
Contact Form Email < 1.3.42 - Captcha Bypass
Published
2024-02-12
Title
WP Editor < 1.2.8 - Sensitive Information Exposure via log file
Published
2014-08-01
Title
WP-Filebase 0.2.9.24- Unspecified Vulnerabilities