WordPress security by component
Advanced Form Integration — Connect Forms to 200+ Apps
Plugin description
Advanced Form Integration — Connect Forms to 200+ Apps is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 28, 2026; the highest CVE/CNA score is 7.6.
Plugin slug:
advanced-form-integrationLatest vulnerability
CVE-2026-16587: Advanced Form Integration subscribers can overwrite MailUp OAuth tokens
Advanced Form Integration through 2.6.0 attaches auth_redirect() to admin_init, which runs when any logged-in user visits a wp-admin page such as /wp-admin/profile.php. A Subscriber can submit action=adfoin_mailup_auth_redirect with an attacker-controlled OAuth code; the function exchanges that code and save_data() writes the resulting access and refresh tokens into the adfoin_mailup_keys option without checking manage_options. This can redirect future form data to an attacker-controlled MailUp account or replace the tokens with unusable values and break the integration.
| Safe version |
|
||
|---|---|---|---|
| Jul 28, 2026 |
CVE-2026-16587
Advanced Form Integration subscribers can overwrite MailUp OAuth tokens
Advanced Form Integration through 2.6.0 attaches auth_redirect() to admin_init, which runs when any logged-in user visits a wp-admin page such as /wp-admin/profile.php. A Subscriber can submit action=adfoin_mailup_auth_redirect with an attacker-controlled OAuth code; the function exchanges that code and save_data() writes the resulting access and refresh tokens into the adfoin_mailup_keys option without checking manage_options. This can redirect future form data to an attacker-controlled MailUp account or replace the tokens with unusable values and break the integration.
|
> 2.6.0 |
CVE4.3
NVDPending
|
| Jun 15, 2026 |
CVE-2026-42659
Advanced Form Integration: A security weakness
Advanced Form Integration is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 1.126.12.
|
1.127.0 |
CVE6.5
NVDPending
|
| Mar 25, 2025 |
CVE-2024-13123
AFI: Cross-site scripting
AFI is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE3.5
NVDPending
|
| Mar 25, 2025 |
CVE-2024-13122
AFI: Cross-site scripting
AFI is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE3.5
NVDPending
|
| Jan 07, 2025 |
CVE-2024-56293
Advanced Form Integration: Cross-site scripting
Advanced Form Integration is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Nov 13, 2024 |
CVE-2024-10877
AFI – The Easiest Integration Plugin: Cross-site scripting
AFI – The Easiest Integration Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Aug 26, 2024 |
CVE-2024-43340
Advanced Form Integration: Cross-site request forgery
Advanced Form Integration is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Mar 20, 2024 |
CVE-2024-2387
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: SQL injection
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Dec 28, 2023 |
CVE-2023-50853
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: SQL injection
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVD7.2
|
| Mar 23, 2023 |
CVE-2022-47173
Advanced Form Integration: Cross-site scripting
Advanced Form Integration is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|