vsourz 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk cross-site scripting and vendor risk csrf などに関し、一部は vendor impact session compromise を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-37245 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Reflected XSS.This issue affects All In One Redirection: from n/a through 2.2.0. | [email protected] | 7.1 | 0.27% | 2024-07-22 | 2026-06-17 |
| CVE-2023-28167 | Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions. | [email protected] | 5.4 | 0.30% | 2023-11-12 | 2026-06-17 |
| CVE-2023-2493 | The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | [email protected] | 7.2 | 1.08% | 2023-07-10 | 2026-06-17 |
| CVE-2022-45285 | Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.50% | 2023-02-13 | 2026-06-17 |
| CVE-2022-29408 | Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress. | [email protected] | 4.7 | 0.66% | 2022-05-25 | 2026-06-17 |
| CVE-2021-24905 | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users. | [email protected] | 8.0 | 0.72% | 2022-03-21 | 2026-06-16 |
| CVE-2018-21012 | The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. | [email protected] | 6.1 | 0.92% | 2019-09-09 | 2026-06-16 |
| CVE-2019-13571 | A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system. | [email protected] | 9.8 | 4.00% | 2019-07-29 | 2026-06-16 |