WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
contact-form-entries
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - SQL Injection
Slug
contact-form-entries
Published
2024-01-30
Title
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Slug
contact-form-entries
Published
2024-03-06
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Slug
contact-form-entries
Published
2024-04-22
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.9 - Unauthenticated Stored Cross-Site Scripting
Slug
contact-form-entries
Published
2025-08-12
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
Slug
contact-form-entries
Published
2026-01-27
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.6 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Slug
contact-form-entries
Published
2026-03-04
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.8 - Unauthenticated PHP Object Injection via 'download_csv'
Slug
contact-form-entries
Published
2026-03-31
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Slug
contact-form-entries
Published
2026-06-19
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Slug
contact-form-entries
Published
2026-06-22
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field
Slug
contact-form-entries
Published
2026-07-01
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
Slug
contact-form-entries
Published
2026-07-07
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
Slug
contact-form-entries
Published
2026-07-10
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Unauthenticated Stored Cross-Site Scripting
Slug
contact-form-entries
Published
2026-07-27
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
Slug
contact-form-extender-for-divi-builder
Published
2026-04-21
Title
Contact Form Extender for Divi – Submissions DB & Extra Fields < 1.0.7 - Unauthenticated Arbitrary File Deletion
Slug
contact-form-generator
Published
2015-09-07
Title
Contact Form Generator < 2.5.5 - Multiple Cross-Site Request Forgery (CSRF)
Slug
contact-form-generator
Published
2023-08-10
Title
Contact Form Generator < 2.6.0 - Reflected XSS
Slug
contact-form-generator
Published
2023-10-09
Title
Contact Form Generator < 2.9.0 - Contributor+ SQLi
Slug
contact-form-integrated-with-google-maps
Published
2014-10-18
Title
Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)
Slug
contact-form-lite
Published
2024-04-12
Title
Easy Contact Form Lite < 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
contact-form-lite
Published
2025-02-23
Title
Contact Form Plugin < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
contact-form-lite
Published
2025-06-09
Title
Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS
Slug
contact-form-maker
Published
2015-11-24
Title
Contact Form Maker <= 1.7.30 - Authenticated Blind SQL Injection
Slug
contact-form-maker
Published
2019-04-05
Title
Contact Form by WD <= 1.13.4 - Cross-Site Request Forgery to LFI
Slug
contact-form-maker
Published
2023-06-15
Title
Contact Form by WD <= 1.13.23 - Admin+ SQLi