WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
contact-form-cfdb7
Published
2024-04-26
Title
Contact Form 7 Database Addon – CFDB7 < 1.2.7 - Unauthenticated Sensitive Information Exposure
Slug
contact-form-cfdb7
Published
2025-07-03
Title
Contact Form 7 Database Addon < 1.3.2 - Unauthenticated Stored XSS via tmpD Parameter
Slug
contact-form-check-tester
Published
2021-04-10
Title
Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)
Slug
contact-form-db-divi
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
contact-form-entries
Published
2021-08-24
Title
Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting
Slug
contact-form-entries
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
contact-form-entries
Published
2021-01-05
Title
Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
Slug
contact-form-entries
Published
2021-11-14
Title
Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
Slug
contact-form-entries
Published
2022-10-21
Title
Contact Form Entries < 1.3.0 - CSV Injection
Slug
contact-form-entries
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - Contributor+ Stored XSS
Slug
contact-form-entries
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - SQL Injection
Slug
contact-form-entries
Published
2024-01-30
Title
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Slug
contact-form-entries
Published
2024-03-06
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Slug
contact-form-entries
Published
2024-04-22
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.3.9 - Unauthenticated Stored Cross-Site Scripting
Slug
contact-form-entries
Published
2025-08-12
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
Slug
contact-form-entries
Published
2026-01-27
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.6 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Slug
contact-form-entries
Published
2026-03-04
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.4.8 - Unauthenticated PHP Object Injection via 'download_csv'
Slug
contact-form-entries
Published
2026-03-31
Title
Database for Contact Form 7, WPforms, Elementor forms < 1.5.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Slug
contact-form-extender-for-divi-builder
Published
2026-04-21
Title
Contact Form Extender for Divi – Submissions DB & Extra Fields < 1.0.7 - Unauthenticated Arbitrary File Deletion
Slug
contact-form-generator
Published
2015-09-07
Title
Contact Form Generator < 2.5.5 - Multiple Cross-Site Request Forgery (CSRF)
Slug
contact-form-generator
Published
2023-08-10
Title
Contact Form Generator < 2.6.0 - Reflected XSS
Slug
contact-form-generator
Published
2023-10-09
Title
Contact Form Generator < 2.9.0 - Contributor+ SQLi
Slug
contact-form-integrated-with-google-maps
Published
2014-10-18
Title
Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)
Slug
contact-form-lite
Published
2024-04-12
Title
Easy Contact Form Lite < 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
contact-form-lite
Published
2025-02-23
Title
Contact Form Plugin < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting