WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
cf7-store-to-db-lite
Published
2022-01-17
Title
Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
Slug
cf7-styler
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cf7-styler
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cf7-styler
Published
2024-05-09
Title
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler < 1.6.5 - Missing Authorization via Several AJAX Action
Slug
cf7-styler
Published
2024-11-12
Title
CF7 WOW Styler < 1.6.9 - Reflected XSS
Slug
cf7-styler
Published
2024-11-04
Title
CF7 WOW Styler < 1.6.9 - Reflected Cross-Site Scripting
Slug
cf7-styler
Published
2025-01-06
Title
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting
Slug
cf7-styler
Published
2025-08-07
Title
CF7 WOW Styler < 1.7.3 - Unauthenticated Local File Inclusion
Slug
cf7-styler
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
cf7-styler-for-divi
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cf7-styler-for-divi
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cf7-submission-dom-tracking
Published
2025-05-07
Title
Submission DOM tracking for Contact Form 7 < 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
cf7-submissions
Published
2025-09-22
Title
CF7 Submissions <= 0.26 - Missing Authorization
Slug
cf7-summary-and-print
Published
2024-07-11
Title
Contact Form 7 Summary and Print < 1.2.6 - Settings Update via CSRF
Slug
cf7-sweet-alert-popup
Published
2025-08-20
Title
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
Slug
cf7-telegram
Published
2024-10-27
Title
Contact Form 7 + Telegram < 0.8.6 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse
Slug
cf7-utm-tracking
Published
2025-03-21
Title
UTM tags tracking for Contact Form 7 <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
cf7-widget-elementor
Published
2024-01-03
Title
Void Contact Form 7 Widget For Elementor Page Builder < 2.4 - Missing Authorization
Slug
cf7-widget-elementor
Published
2024-07-01
Title
Void Contact Form 7 Widget For Elementor Page Builder < 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute
Slug
cf7-widget-elementor
Published
2024-08-16
Title
Void Contact Form 7 Widget For Elementor Page Builder < 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
cf7-zendesk
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
cf7-zendesk
Published
2025-04-04
Title
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.4 - Cross-Site Request Forgery
Slug
cf7-zendesk
Published
2026-03-02
Title
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.6 - Unauthenticated Stored Cross-Site Scripting
Slug
cf7-zoho
Published
2021-08-25
Title
Contact Form 7 Zoho < 1.1.8 - Reflected Cross-Site Scripting
Slug
cf7-zoho
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting