Advisories · Technology
boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress.
Every CVE that names boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
- boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Path traversal
- CVSS 6.4 Medium
weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
- boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer
- boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Cross-site scripting (XSS)