Plugin icon

Database for Contact Form 7, WPforms, Elementor forms

contact-form-entries

Vulnerabilities:

14

Last Updated:

May 17, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-03-31
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Fixed in
Fixed in 1.5.0
CVSS
2.7 (low)
Published
2026-03-04
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.8 - Unauthenticated PHP Object Injection via 'download_csv'
Fixed in
Fixed in 1.4.8
CVSS
9.8 (critical)
Published
2026-01-27
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.6 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Fixed in
Fixed in 1.4.6
CVSS
5.3 (medium)
Published
2025-08-12
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
Fixed in
Fixed in 1.4.4
CVSS
9.8 (critical)
Published
2024-04-22
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.9 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.9
CVSS
7.2 (high)
Published
2024-03-06
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Fixed in
Fixed in 1.3.4
CVSS
6.4 (medium)
Published
2024-01-30
Title
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Fixed in
Fixed in 1.3.3
CVSS
4.7 (medium)
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - SQL Injection
Fixed in
Fixed in 1.3.1
CVSS
6.8 (medium)
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - Contributor+ Stored XSS
Fixed in
Fixed in 1.3.1
CVSS
6.5 (medium)
Published
2022-10-21
Title
Contact Form Entries < 1.3.0 - CSV Injection
Fixed in
Fixed in 1.3.0
CVSS
4.7 (medium)
Published
2021-11-14
Title
Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.2.4
CVSS
7.5 (high)
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.2.2
CVSS
8.8 (high)
Published
2021-08-24
Title
Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.2.1
CVSS
7.1 (high)
Published
2021-01-05
Title
Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.7
CVSS
7.5 (high)