Web-Settler form builder vulnerabilities

Latest Web-Settler form builder CVEs

Newest publication first

1. CVE-2023-23796 WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection

   Published 2023-11-07

   Critical·CVSS 9.8 EPSS 0.62%

   Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.

2. CVE-2023-23795 WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-06-22

   High·CVSS 8.8 EPSS 0.26%

   Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.

3. CVE-2021-24513 Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting

   Published 2021-09-06

   Medium·CVSS 5.4 EPSS 0.62%

   The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.