Mw Wp Form

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:web-soudan:mw_wp_form:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorWeb Soudan (b66f8863-7588-57c5-90f6-c1620acbd648)
ProductMw Wp Form (f35534a7-5223-5b35-a55f-b70d21fab7f6)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/inc2734/mw-wp-form purl2cpe 2026-06-01 10:16:09.175784

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-24804 vulnerable 2026-06-08 06:29:41.802634 WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6.
Published: 2024-02-10T07:45:51.290Z
Updated: 2026-04-28T16:09:10.656Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-6559 vulnerable 2026-06-08 06:21:54.862194 MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion
HIGH (7.5)
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Published: 2023-12-16T12:29:16.960Z
Updated: 2026-04-08T16:48:36.983Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.