deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1790
Published: 2024-04-09
Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This is limited to Windows instances.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/admin/functions/layouts.php#L14; https://plugins.trac.wordpress.org/changeset/3056137/ajax-load-more/tags/7.1.0/admin/functions/layouts.php; https://plugins.trac.wordpress.org/changeset/3056137/ajax-load-more/tags/7.1.0/core/functions.php
CVE: CVE-2024-1792
Published: 2024-04-09
Description: The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Please note that the plugin is a developer toolkit. For the vulnerability to become exploitable, the presence of a metabox activation in your code (via functions.php for example) is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset/3062907/cmb2/trunk?contextall=1&old=2683046&old_path=%2Fcmb2%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f37ef5-ddf5-4bd5-b6aa-121dda22fb01?source=cve; https://plugins.trac.wordpress.org/changeset/3062907/cmb2/trunk?contextall=1&old=2683046&old_path=%2Fcmb2%2Ftrunk
CVE: CVE-2024-1794
Published: 2024-04-09
Description: The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047085%40forminator&old=3028842%40forminator&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/23feb72c-7e6f-436b-b56e-dc6185302d31?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047085%40forminator&old=3028842%40forminator&sfp_email=&sfph_mail=
CVE: CVE-2024-1812
Published: 2024-04-09
Description: The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://plugins.trac.wordpress.org/changeset/3049743/everest-forms; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4561441-d147-4c02-a837-c1656e17627d?source=cve; https://plugins.trac.wordpress.org/changeset/3049743/everest-forms
CVE: CVE-2024-1813
Published: 2024-04-09
Description: The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=
CVE: CVE-2024-1850
Published: 2024-04-09
Description: The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions. CVE-2024-32713 may be a duplicate of this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3056020%40ai-post-generator&new=3056020%40ai-post-generator&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3057511%40ai-post-generator&new=3057511%40ai-post-generator&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/43fc47ca-15ca-4817-b1b8-389245725e73?source=cve
CVE: CVE-2024-1852
Published: 2024-04-09
Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page which is the edit users page. This vulnerability was partially patched in version 3.4.9.2, and was fully patched in 3.4.9.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/class-wp-members-user-profile.php#L566; https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/class-wp-members-user.php#L524; https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/vendor/rocketgeek-utilities/includes/utilities.php#L168
CVE: CVE-2024-1893
Published: 2024-04-09
Description: The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.2/lib/includes/functions.php#L1846; https://plugins.trac.wordpress.org/changeset?old_path=/easy-property-listings/tags/3.5.2&old=3056209&new_path=/easy-property-listings/tags/3.5.3&new=3056209&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ac96db-2d9a-4eaf-8916-a02e3e64ca4a?source=cve
CVE: CVE-2024-1904
Published: 2024-04-09
Description: The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3050967/masterstudy-lms-learning-management-system; https://www.wordfence.com/threat-intel/vulnerabilities/id/1be686d3-16b1-4ec7-b304-848ca4d7162c?source=cve; https://plugins.trac.wordpress.org/changeset/3050967/masterstudy-lms-learning-management-system
CVE: CVE-2024-1934
Published: 2024-04-09
Description: The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.10.35/addons/legacy/compress.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054445@wp-compress-image-optimizer/trunk&old=3048575@wp-compress-image-optimizer/trunk&sfp_email=&sfph_mail=#file2; https://www.wordfence.com/threat-intel/vulnerabilities/id/88a46a24-6d46-44cc-ac01-70a1c329cb51?source=cve
CVE: CVE-2024-1948
Published: 2024-04-09
Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3055393#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbe4748-6e87-4332-b84f-615aec67bcec?source=cve; https://plugins.trac.wordpress.org/changeset/3055393#file4
CVE: CVE-2024-1960
Published: 2024-04-09
Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Special Offer Day Widget Banner Link in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/special_day_offer.php#L784; https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/special_day_offer.php#L805; https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/tags/2.8.2/includes/addons/special_day_offer.php?old=2704778&old_path=woolentor-addons/trunk/includes/addons/special_day_offer.php
CVE: CVE-2024-1974
Published: 2024-04-09
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_weather.php#L401; https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/tags/2.4.7/includes/widgets/htmega_weather.php?old=2939273&old_path=ht-mega-for-elementor/trunk/includes/widgets/htmega_weather.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/11b5f0a1-bf22-46be-a165-c62f1077da0f?source=cve
CVE: CVE-2024-1984
Published: 2024-04-09
Description: The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=221417%40graphene%2F2.9.3&old=164915%40graphene%2F2.9; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f19051-fe80-469c-a514-ec3a848a4015?source=cve; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=221417%40graphene%2F2.9.3&old=164915%40graphene%2F2.9
CVE: CVE-2024-1990
Published: 2024-04-09
Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3049490/custom-registration-form-builder-with-submission-manager/trunk/public/class_rm_public.php; https://plugins.trac.wordpress.org/changeset/3057216/custom-registration-form-builder-with-submission-manager/trunk/public/class_rm_public.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6478cdbc-a20e-4fe2-bbd6-8a550e5da895?source=cve
CVE: CVE-2024-1991
Published: 2024-04-09
Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk//services/class_rm_user_services.php#L1205; https://plugins.trac.wordpress.org/changeset/3049490/custom-registration-form-builder-with-submission-manager#file24; https://www.wordfence.com/threat-intel/vulnerabilities/id/766e3966-157a-4db3-9[PII_REDACTED]43f76?source=cve
CVE: CVE-2024-1999
Published: 2024-04-09
Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.25/includes/blocks/class-kadence-blocks-testimonial-block.php#L88; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047463%40kadence-blocks%2Ftrunk&old=3042198%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd4dbe-6f44-45ef-9d49-4bc624fdcc57?source=cve
CVE: CVE-2024-24245
Published: 2024-04-09
Description: An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the ClamXAV helper tool component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.clamxav.com/version-history/; https://www.clamxav.com/version-history/
CVE: CVE-2024-2018
Published: 2024-04-09
Description: The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://melapress.com/support/kb/wp-activity-log-plugin-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f060ea1-01e2-4e5b-82ba-b5cdd0d8290a?source=cve; https://melapress.com/support/kb/wp-activity-log-plugin-changelog/
CVE: CVE-2024-2026
Published: 2024-04-09
Description: The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/content-protector/trunk/inc/class-ps-public.php#L48; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064573%40content-protector&new=3064573%40content-protector&sfp_email=&sfph_mail=#file7; https://www.wordfence.com/threat-intel/vulnerabilities/id/880f1f3f-857c-46da-a65c-082348260f89?source=cve
CVE: CVE-2024-2027
Published: 2024-04-09
Description: The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3050229%40real-media-library-lite%2Ftrunk&old=3041112%40real-media-library-lite%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/67a44d4c-da3f-4c3d-997b-1417c6906a9c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3050229%40real-media-library-lite%2Ftrunk&old=3041112%40real-media-library-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2033
Published: 2024-04-09
Description: The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all users on a site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3054964/video-conferencing-with-zoom-api/trunk?contextall=1&old=3048839&old_path=%2Fvideo-conferencing-with-zoom-api%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/0966057b-8a3c-4d3c-84cb-cf36f1d97922?source=cve; https://plugins.trac.wordpress.org/changeset/3054964/video-conferencing-with-zoom-api/trunk?contextall=1&old=3048839&old_path=%2Fvideo-conferencing-with-zoom-api%2Ftrunk
CVE: CVE-2024-2039
Published: 2024-04-09
Description: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post(v2) block title tag in all versions up to, and including, 3.12.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3058710/stackable-ultimate-gutenberg-blocks/tags/3.12.12/src/deprecated/v2/block/blog-posts/index.php?old=3037996&old_path=stackable-ultimate-gutenberg-blocks/tags/3.12.11/src/deprecated/v2/block/blog-posts/index.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/daa30b1b-cb8f-43fd-8329-c64b4024408f?source=cve; https://plugins.trac.wordpress.org/changeset/3058710/stackable-ultimate-gutenberg-blocks/tags/3.12.12/src/deprecated/v2/block/blog-posts/index.php?old=3037996&old_path=stackable-ultimate-gutenberg-blocks/tags/3.12.11/src/deprecated/v2/block/blog-posts/index.php
CVE: CVE-2024-2081
Published: 2024-04-09
Description: The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save action in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/fooplugins/foogallery; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3057349%40foogallery&old=3039397%40foogallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2edeb63-56ad-45e7-9e85-cdf0a8ef41e7?source=cve
CVE: CVE-2024-2093
Published: 2024-04-09
Description: The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/vektor-inc/vk-all-in-one-expansion-unit/pull/1072; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050823%40vk-all-in-one-expansion-unit&new=3050823%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2b5dca-42a5-49d4-800d-b268572968a9?source=cve
CVE: CVE-2024-2112
Published: 2024-04-09
Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://plugins.trac.wordpress.org/changeset?old_path=/form-maker/tags/1.15.22&old=3057012&new_path=/form-maker/tags/1.15.23&new=3057012&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5652f9c3-3cc9-4541-8209-40117b4d25d9?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/form-maker/tags/1.15.22&old=3057012&new_path=/form-maker/tags/1.15.23&new=3057012&sfp_email=&sfph_mail=