10Web Form Maker vulnerabilities

CVE-2022-1564 [MEDIUM] CWE-79 CVE-2022-1564: The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVE-2021-24526 [MEDIUM] CWE-79 CVE-2021-24526: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue

CVE-2019-10866 [CRITICAL] CWE-89 CVE-2019-10866: In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.

CVE-2019-11590 [HIGH] CWE-22 CVE-2019-11590: The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.