Contact Form Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:bitapps:contact_form_builder:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Bitapps (f58f35eb-93f9-599d-b6d5-68faa76ec9db) |
|---|---|
| Product | Contact Form Builder (3c153fbf-62de-5b3b-a886-be415f342fe1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-7782 |
vulnerable | 2026-06-08 06:58:23.416573 |
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion
HIGH (8.7)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Published: 2024-08-20T03:21:11.466Z
Updated: 2024-09-03T15:14:10.502Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7780 |
vulnerable | 2026-06-08 06:58:23.415752 |
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection
HIGH (7.2)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2024-08-20T03:21:10.510Z
Updated: 2024-08-21T19:28:00.702Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7777 |
vulnerable | 2026-06-08 06:58:23.411313 |
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
CRITICAL (9)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Published: 2024-08-20T03:21:08.998Z
Updated: 2024-08-20T13:14:05.606Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7775 |
vulnerable | 2026-06-08 06:58:23.408214 |
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
MEDIUM (5.5)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
Published: 2024-08-20T03:21:08.498Z
Updated: 2024-08-20T13:47:52.933Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7702 |
vulnerable | 2026-06-08 06:58:23.184089 |
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
HIGH (7.2)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the entryID parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.
Published: 2024-08-20T03:21:07.859Z
Updated: 2024-08-20T16:20:05.224Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1640 |
vulnerable | 2026-06-08 06:27:13.956851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13450 |
vulnerable | 2026-06-08 06:25:37.709649 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3645 |
vulnerable | 2026-06-08 06:09:40.087062 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.