GCVE - cpe:2.3:a:unknown:visual_form_builder:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:visual_form_builder:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Visual Form Builder (`4afef100-cf48-57ac-8749-7438247b2e3b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-1046`	vulnerable	2026-06-08 05:39:12.050951	Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Published: 2022-05-02T16:05:48.000Z Updated: 2024-08-02T23:47:43.426Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/a1ae4512-0b5b-4f36-8334-14633bf24758	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0142`	vulnerable	2026-06-08 05:39:09.330070	Visual Form Builder < 3.0.6 - CSV Injection The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. Published: 2022-04-12T11:15:23.000Z Updated: 2024-08-02T23:18:41.999Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878 https://www.fortiguard.com/zeroday/FG-VD-21-080	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0141`	vulnerable	2026-06-08 05:39:09.329580	Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks Published: 2022-04-12T11:15:22.000Z Updated: 2024-08-02T23:18:41.711Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/2adc8390-bb19-4adf-9805-e9c462d14d22 https://www.fortiguard.com/zeroday/FG-VD-21-081	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0140`	vulnerable	2026-06-08 05:39:09.328217	Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint. Published: 2022-04-12T11:15:20.000Z Updated: 2024-08-02T23:18:41.793Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336 https://www.fortiguard.com/zeroday/FG-VD-21-082	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24514`	vulnerable	2026-06-08 05:30:04.503731	Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed Published: 2021-10-25T13:20:39.000Z Updated: 2024-08-03T19:35:19.892Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/0afa78d3-2403-4e0c-8f16-5b7874b03cd2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.