These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies. This vulnerability requires verification of the plugin version and access restrictions to debug file [truncated]
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API. This vulnerability poses privacy concerns and requires verification of plugin version and update to 4.3.1 or later. The issue is related to insufficient access controls in the plugin, enabling unauthorized access to sens [truncated]
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header. This vulnerability affects WordPress sites using the MetForm plu [truncated]