{"api_version":"1","generated_at":"2026-07-23T09:13:36+00:00","cve":"CVE-2014-4536","urls":{"html":"https://cve.report/CVE-2014-4536","api":"https://cve.report/api/cve/CVE-2014-4536.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-4536","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-4536"},"summary":{"title":"CVE-2014-4536","description":"Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-12-27 20:15:00","updated_at":"2020-01-07 15:57:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss","name":"http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"wp-plugin : infusionsoft – A3-Cross-Site Scripting (XSS) | Code Vigilant","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://wordpress.org/plugins/infusionsoft/changelog","name":"http://wordpress.org/plugins/infusionsoft/changelog","refsource":"CONFIRM","tags":["Release Notes"],"title":"WordPress › Infusionsoft Gravity Forms Add-on « WordPress Plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4536","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4536","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"4536","vulnerable":"1","versionEndIncluding":"1.5.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"katz","cpe5":"infusionsoft_gravity_forms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-4536","STATE":"PUBLIC"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"references":{"reference_data":[{"refsource":"MISC","name":"http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss","url":"http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss"},{"refsource":"CONFIRM","name":"http://wordpress.org/plugins/infusionsoft/changelog","url":"http://wordpress.org/plugins/infusionsoft/changelog"}]}},"nvd":{"publishedDate":"2019-12-27 20:15:00","lastModifiedDate":"2020-01-07 15:57:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:katz:infusionsoft_gravity_forms:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"1.5.6","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"4536","Ordinal":"71505","Title":"CVE-2014-4536","CVE":"CVE-2014-4536","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"4536","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.","Type":"Description","Title":null},{"CveYear":"2014","CveId":"4536","Ordinal":"2","NoteData":"2019-12-27","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"4536","Ordinal":"3","NoteData":"2019-12-27","Type":"Other","Title":"Modified"}]}}}