CVE-2019-25734: Improper Limitation of a Pathname to a Restricted Directory

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint...

CVE-2023-2655: Improper Neutralization of Special Elements used in an SQL Command

The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

PT-2024-12104

Name of the Vulnerable Software and Affected Versions The Contact Form by WD WordPress plugin versions 1.13.23 and earlier Description The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement. This ca...