CVE-2014-4536
CVE-2014-4536
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 3.9%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
27 Dec 2019Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
Affected products
n/a · n/a