Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
754 results · page 15 of 16
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Contact Form, Drag and Drop Form Builder for
- Fixed in
- 1.8.0
- What to do
- Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
- Product
- Contact Form Advanced Database
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Contact Form, Survey & Popup Form Plugin for
- Fixed in
- 1.5
- What to do
- Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Nov 29, 2021Contact Form With Captcha: Cross-Site Request ForgeryCVE-2021-42358 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2.
- Product
- Contact Form With Captcha
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Contact Form With Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Contact Form Email
- Affected
- up to 1.3.24
- What to do
- Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- WordPress Contact Forms by Cimatti
- Fixed in
- 1.4.12
- What to do
- Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
- Fixed in
- 5.0.07
- What to do
- Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.5.8.2
- What to do
- Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Sep 6, 2021Form Builder | Create Responsive Contact Forms: Does not sanitise or escape its Form TitleCVE-2021-24513 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
- Product
- Form Builder | Create Responsive Contact Forms
- Fixed in
- 1.9.8.4
- What to do
- Update Form Builder | Create Responsive Contact Forms to 1.9.8.4 or newer.
Aug 23, 2021Contact Form 7 Captcha: Does not have any CSRF check in placeCVE-2021-24565 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.0.9
- What to do
- Update Contact Form 7 Captcha to 0.0.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 16, 2021Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Does not escape its Form Title before outputting it in an attributeCVE-2021-24526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Fixed in
- 1.13.60
- What to do
- Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to 1.13.60 or newer.
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pluCVE-2021-24282 · WordPress plugins & themes · reported by WPScanMedium 6.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action CVE-2021-24281 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action tCVE-2021-24280 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to instalCVE-2021-24279 · WordPress plugins & themes · reported by WPScanMedium 6.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce foCVE-2021-24278 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
- Product
- Contact Form Check Tester
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 5, 2021Easy Contact Form Pro: Did not properly sanitise the text fields (suchCVE-2021-24168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
- Product
- Easy Contact Form Pro
- Fixed in
- 1.1.1.9
- What to do
- Update Easy Contact Form Pro to 1.1.1.9 or newer.
Apr 5, 2021wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for: Had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connectionCVE-2021-24166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
- Product
- wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for
- Fixed in
- 3.4.34
- What to do
- Update wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.4.34
- What to do
- Update Ninja Forms Contact Form to 3.4.34 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.4.34.1
- What to do
- Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 18, 2021Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitraryCVE-2021-24144 · WordPress plugins & themes · reported by WPScanHigh 7.8
Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.
- Fixed in
- 1.2.5.6
- What to do
- Update the plugin to 1.2.5.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site ScriptinCVE-2021-24134 · WordPress plugins & themes · reported by WPScanMedium 4.8
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
- Product
- Constant Contact Forms
- Fixed in
- 1.8.8
- What to do
- Update Constant Contact Forms to 1.8.8 or newer.
Mar 18, 2021Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitCVE-2021-24125 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)
- Product
- Contact Form Submissions
- Fixed in
- 1.7.1
- What to do
- Update Contact Form Submissions to 1.7.1 or newer.
Jan 12, 2021The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.CVE-2021-3133 · WordPress plugins & themes · reported by MITREMedium 6.5
The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
- Product
- Elementor Contact Form DB
- Fixed in
- 1.6
- What to do
- Update Elementor Contact Form DB to 1.6 or newer.
Full record and what to do →NVD recordadvisory.checkmarx.netplugins.trac.wordpress.org
Dec 17, 2020The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contaCVE-2020-35489 · WordPress plugins & themes · reported by MITRECritical 10
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
- Product
- contact-form-7 (aka Contact Form 7)
- Fixed in
- 5.3.2
- What to do
- Update contact-form-7 (aka Contact Form 7) to 5.3.2 or newer.
Full record and what to do →NVD recordcontactform7.comwordpress.org
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
- Product
- Stored XSS in the Contact Form 7 Datepicker
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 24, 2020A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.CVE-2020-10385 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
- Product
- A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite)
- Fixed in
- 1.5.9
- What to do
- Update A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) to 1.5.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Jan 23, 2020The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSSCVE-2014-7238 · WordPress plugins & themes · reported by MITREMedium 6.1
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
- Affected
- 1.0 to 2.4
- What to do
- Affects 1.0 to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Nov 26, 2019The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.CVE-2015-9539 · WordPress plugins & themes · reported by MITREMedium 6.1
The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.
- Product
- Fast Secure Contact Form
- Fixed in
- 4.0.38
- What to do
- Update Fast Secure Contact Form to 4.0.38 or newer.
Full record and what to do →NVD recordcybersecurityworks.comgithub.com
Oct 10, 2019The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.CVE-2019-17072 · WordPress plugins & themes · reported by MITRECritical 9.8
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
- Affected
- 1.0.9 to 1.0.9
- What to do
- Affects 1.0.9 to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordpress.org
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
- Product
- CP Contact Form with PayPal
- Fixed in
- 1.2.98
- What to do
- Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
- Product
- CP Contact Form with PayPal
- Fixed in
- 1.2.99
- What to do
- Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Apr 29, 2019The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion CVE-2019-11591 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
- Product
- WebDorado Contact Form
- Fixed in
- 1.13.5
- What to do
- Update WebDorado Contact Form to 1.13.5 or newer.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Apr 26, 2019The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inCVE-2019-11557 · WordPress plugins & themes · reported by MITREHigh 8.8
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
- Product
- WebDorado Contact Form Builder
- Fixed in
- 1.0.69
- What to do
- Update WebDorado Contact Form Builder to 1.0.69 or newer.
Full record and what to do →NVD recordseclists.orglists.openwall.net
Mar 10, 2019The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition areCVE-2019-9646 · WordPress plugins & themes · reported by MITREMedium 6.1
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
- Product
- Contact Form Email
- Fixed in
- 1.2.66
- What to do
- Update Contact Form Email to 1.2.66 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] CVE-2019-9568 · WordPress plugins & themes · reported by MITREMedium 6.5
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.
- Product
- Forminator Contact Form, Poll & Quiz Builder
- Fixed in
- 1.6
- What to do
- Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
- Product
- Forminator Contact Form, Poll & Quiz Builder
- Fixed in
- 1.6
- What to do
- Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Apr 4, 2018ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for: CSV InjectionCVE-2018-9035 · WordPress plugins & themes · reported by MITRECritical 9.6
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.
- Product
- ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for
- What to do
- Update ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 6, 2017Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web scripCVE-2014-7240 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a master_response action to wp-admin/admin-ajax.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution
- Fixed in
- 1.7
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution to 1.7 or newer.
Full record and what to do →NVD recordg0blin.co.ukwpvulndb.com
Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cCVE-2015-9234 · WordPress plugins & themes · reported by MITREHigh 7.2
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
- Product
- cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
- Fixed in
- 1.1.6
- What to do
- Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.phpCVE-2015-9233 · WordPress plugins & themes · reported by MITREHigh 8.8
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
- Product
- cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
- Fixed in
- 1.1.6
- What to do
- Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 16, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijackCVE-2015-6965 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.
- Product
- Contact Form Generator
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Jun 9, 2015Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authenticatiCVE-2015-4010 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
- Product
- Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form
- Fixed in
- 1.1
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form to 1.1 or newer.
Full record and what to do →NVD recordmarc.infopacketstormsecurity.com
Mar 9, 2015Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress alCVE-2015-1874 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
- Fixed in
- 2.8.32
- What to do
- Update the plugin to 2.8.32 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 20, 2015Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote atCVE-2015-2040 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
- Product
- Contact Form DB (aka CFDB and contact-form-7-to-database-extension)
- Affected
- 2.8.26 to 2.8.26
- What to do
- Affects 2.8.26 to 2.8.26. Update Contact Form DB (aka CFDB and contact-form-7-to-database-extension) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Feb 20, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the CVE-2015-2039 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
- Product
- Acobot Live Chat & Contact Form
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update Acobot Live Chat & Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Nov 17, 2014Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPCVE-2014-8955 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the cscf[name] parameter to contact-us/.
- Product
- Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas)
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.