INFINITUM FORM vulnerabilities and threats

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.6%	CVE-2026-78286Geo Controller (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.6%2026-08-27CVE Database V5CVE-2026-78286 CVE-2026-78286 is a critical vulnerability in INFINITUM FORM Geo Controller versions up to 8.9.8. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. EPSS 0.6%Vulnerability INFINITUM FORM CWE-502 #ghsa-3h99-6f5g-6j4m	CVE Database V5	2026-08-27
Medium	5.3	EPSS 0.3%	CVE-2025-62109Geo Controller (WordPress plugin) · Insertion of Sensitive Information Into Sent Data Medium5.3EPSS 0.3%2025-12-09CVE Database V5CVE-2025-62109 Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4. EPSS 0.3%Vulnerability INFINITUM FORM CWE-201	CVE Database V5	2025-12-09
Medium	6.5	EPSS 0.4%	CVE-2024-30451Geo Controller (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.4%2024-03-29CVE Database V5CVE-2024-30451 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4. EPSS 0.4%Vulnerability INFINITUM FORM CWE-79	CVE Database V5	2024-03-29
Critical	9.0	EPSS 0.6%	CVE-2024-30227Geo Controller (WordPress plugin) · Deserialization of Untrusted Data Critical9.0EPSS 0.6%2024-03-28CVE Database V5CVE-2024-30227 Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4. EPSS 0.6%Vulnerability INFINITUM FORM CWE-502	CVE Database V5	2024-03-28

Page 1 of 1