easyregistrationforms Easy Registration Forms vulnerabilities

Latest easyregistrationforms Easy Registration Forms CVEs

Newest publication first

1. CVE-2023-5134 Easy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode

   Published 2023-09-23

   Medium·CVSS 4.3 EPSS 0.52%

   The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated...

2. CVE-2021-39353 Easy Registration Forms <= 2.1.1 Cross-Site Request Forgery to Stored Cross-Site Scripting

   Published 2021-11-19

   High·CVSS 8.8 EPSS 0.72%

   The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up...

3. CVE-2020-22275 Easy Registration Forms <= 2.0.6 - CSV Injection

   Published 2020-11-04

   High·CVSS 8.8 EPSS 2.2%

   Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.