WordPress Plugin Vulnerabilities

Contact Form for WordPress – Ultimate Form Builder Lite <= 1.3.6 - SQL Injection

Description

The Contact Form for WordPress – Ultimate Form Builder Lite WordPress plugin was affected by a SQL Injection security vulnerability.

Affects Plugins

Plugin icon
ultimate-form-builder-lite
Fixed in 1.3.7

References

CVE
CVE-2017-15919
URL
https://www.wordfence.com/blog/2017/10/zero-day-vulnerability-ultimate-form-builder-lite/
URL
https://plugins.trac.wordpress.org/changeset/1750550/ultimate-form-builder-lite

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
e0046ad6-ca27-4e9f-a989-9675a60c4aa8

Timeline

Publicly Published
2017-10-23 (about 8 years ago)
Added
2017-10-23 (about 8 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2015-03-17
Title
WP All Import Pro <= 4.1.1 - Multiple Vulnerabilities
Published
2019-07-08
Title
WP Custom Body Class <= 0.7.0 - CSRF to Stored XSS and Settings Update
Published
2014-08-01
Title
Slash WP - FPD, XSS & CS vulnerabilities
Published
2019-07-23
Title
WPS Limit Login <= 1.4.5 - Multiple Issues
Published
2015-01-12
Title
Banner Effect Header 1.2.6 - XSS & CSRF