WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
contact-form-7-paypal-add-on
Published
2026-05-28
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.4.10 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Slug
contact-form-7-paypal-add-on
Published
2026-07-06
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
Slug
contact-form-7-paypal-add-on
Published
2026-08-11
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.5.2 - Missing Authorization
Slug
contact-form-7-paypal-extension
Published
2026-03-01
Title
Accept PayPal Payments using Contact Form 7 < 4.0.7 - Missing Authorization
Slug
contact-form-7-paypal-extension
Published
2026-10-08
Title
Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
Slug
contact-form-7-paypal-extension
Published
2026-10-08
Title
Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
Slug
contact-form-7-recaptcha
Published
2025-07-04
Title
Contact Form 7 reCAPTCHA <= 1.2.0 - Cross-Site Request Forgery
Slug
contact-form-7-recaptcha
Published
2025-08-22
Title
Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI']
Slug
contact-form-7-round-robin-lead-distribution
Published
2025-01-16
Title
Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Authenticated (Administrator+) SQL Injection
Slug
contact-form-7-round-robin-lead-distribution
Published
2025-01-16
Title
Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Reflected Cross-Site Scripting
Slug
contact-form-7-select-box-editor-button
Published
2025-03-11
Title
Contact Form 7 Select Box Editor Button <= 0.6 - Cross-Site Request Forgery
Slug
contact-form-7-signature-addon
Published
2026-10-14
Title
Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
Slug
contact-form-7-simple-recaptcha
Published
2021-07-26
Title
Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
Slug
contact-form-7-simple-recaptcha
Published
2022-06-27
Title
Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting
Slug
contact-form-7-simple-recaptcha
Published
2026-09-07
Title
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Slug
contact-form-7-skins
Published
2022-01-03
Title
Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)
Slug
contact-form-7-skins
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
contact-form-7-sms-addon
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
contact-form-7-star-rating
Published
2025-02-24
Title
Contact Form 7 Star Rating <= 1.10 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
contact-form-7-star-rating-with-font-awersome
Published
2025-02-24
Title
Contact Form 7 Star Rating with font Awesome <= 1.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
contact-form-7-style
Published
2021-02-04
Title
Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
contact-form-7-style
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
contact-form-7-style
Published
2021-06-21
Title
Contact Form 7 Style <= 3.2 - Cross-Site Request Forgery
Slug
contact-form-7-to-database-extension
Published
2014-10-09
Title
Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)
Slug
contact-form-7-to-database-extension
Published
2014-11-26
Title
Contact Form DB <= 2.8.17 - Reflected XSS in Admin Area