Flothemes Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Flothemes products.
Products
- flo_forms2 vulnerabilities
- Flo Forms1 vulnerability
- Flo Forms – Easy Drag & Drop Form Builder1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-35174MEDIUM | WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Flothemes Flo Forms.This issue affects Flo Forms: from n/a through 1.0.42. CWE-862May 17, 2024 | CVSS5.3v3.1 | EPSS0.327% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-35095MEDIUM | WordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions. CWE-79Jun 20, 2023 | CVSS5.9v3.1 | EPSS0.369% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-4367MEDIUM | Flo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site ScriptingThe Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the flo_import_forms_options AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing capability checks. This makes it possible for authenticated attackers, like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Jun 7, 2023 | CVSS6.4v3.1 | EPSS0.67% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |