Keap vulnerabilities

Products

• Keap Official Opt-in Forms 2
• official opt-in forms 2
• Keap Landing Pages 1
• keap official opt in forms 1

Latest Keap CVEs

Newest publication first

1. CVE-2024-13725 Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion

   Published 2025-02-18

   Critical·CVSS 9.8 EPSS 1.4%

   The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any...

2. CVE-2024-47642 WordPress Keap Official Opt-in Forms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-05

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms infusionsoft-official-opt-in-forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through <= 2.0.3.

3. CVE-2023-52192 WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)

   Published 2024-02-01

   Medium·CVSS 5.4 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.

4. CVE-2023-6941 Keap Official Opt-in Forms <= 1.0.11 - Admin+ Stored XSS

   Published 2024-01-15

   Medium·CVSS 4.8 EPSS 0.40%

   The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl...

5. CVE-2023-44241 WordPress Keap Landing Pages Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-10-10

   High·CVSS 8.8 EPSS 0.27%

   Cross-Site Request Forgery (CSRF) vulnerability in Keap Keap Landing Pages plugin <= 1.4.2 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.