CVE-2022-0141: vulnerability in Visual Form Builder
Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks
Affected products
Unknown · Visual Form BuilderRelated CVEs — Visual Form Builder
In the same product, most dangerous first.
CVE-2022-0140—Visual Form Builder < 3.0.6 - Unauthenticated Information DisclosureEPSS 3.8%CVE-2022-0142—Visual Form Builder < 3.0.6 - CSV InjectionEPSS 2.9%CVE-2021-24514—Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1046—Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-105974MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetEPSS 0.2%CVE-2026-105973MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationEPSS 0.2%