CVE Intelligence

Hassantafreshi vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hassantafreshi products: 4 record(s), with severity, exploitation and fixes.

Easy Form Builder 3Easy Form Builder by WhiteStudio — Drag & Drop Form Builder 1

Exploited only (KEV) →

CVE-2026-42747 Critical · 9.3 CWE-89 May 27, 2026
Easy Form Builder WordPress Plugin - Blind SQL Injection (CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.
CVE-2025-14067 Medium · 5.3 CWE-862 Feb 14, 2026
Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).
CVE-2026-22472 Medium · 4.3 CWE-862 Jan 22, 2026
WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.
CVE-2025-67577 Medium · 5.3 CWE-862 Dec 9, 2025
WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.