Vulnerabilities > Ncrafts > Formcraft > 3.2.30

DATE CVE VULNERABILITY TITLE RISK
2023-06-27 CVE-2023-2592 SQL Injection vulnerability in Ncrafts Formcraft
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
network
low complexity
ncrafts CWE-89
7.2
7.2
2019-09-10 CVE-2017-18600 Cross-site Scripting vulnerability in Ncrafts Formcraft
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
network
ncrafts CWE-79
3.5
3.5