CVE Intelligence

Vulnerabilidades do Loopus WP Cost Estimation & Payment Forms Builder

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Loopus WP Cost Estimation & Payment Forms Builder: 4 registro(s), com versões afetadas e correções.

CVE-2026-9253 Alta · 7.2 CWE-79 09/07/2026
WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-24363 Alta · 7.5 CWE-862 25/03/2026
WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.
CVE-2019-25296 Crítica · 9.8 CWE-434 08/01/2026
WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete
The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.
CVE-2019-25295 Média · 6.5 CWE-22 07/01/2026
WP Cost Estimation < 9.660 - Upload Directory Traversal
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.