Strategy11team vulnerabilities
We track 7 vulnerabilities in Strategy11team products across 6 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Strategy11team vulnerabilities
- 8.8 High severity
Formidable Forms – Contact Form, Survey, Quiz…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to i
- 7.2 High severity
Formidable Forms – WordPress Form Builder for…: Improper Neutralization of Input During Web Page Generation
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient inpu
- 7.5 High severity
AWP Classifieds: Improper Neutralization of Special Elements used in an SQL Command
The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin
- 7.5 High severity
Formidable Forms – Contact Form Plugin…: Missing Authorization
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based
- 7.5 High severity
Business Directory Plugin – Easy Listing…: Improper Neutralization of Special Elements used in an SQL Command
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied para
- 8.0 High severity
Business Directory Plugin – Easy Listing…: Improper Neutralization of Formula Elements in a CSV File
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted inpu
- 7.5 High severity
Business Directory Plugin – Easy Listing…: Improper Neutralization of Special Elements used in an SQL Command
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplie