CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14870

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-14870 Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

EUVD-2026-49701

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

EUVD-2026-49664

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

EUVD-2026-49663

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439

The CVE-2026-65439 entry describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Ultimate Addons for Contact Form 7” affecting versions

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65438

CVE-2026-65438 affects the WordPress plugin “Message Filter for Contact Form 7” (versions up to 1.6.3.9). The issue is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the plugin’s message filtering functionality. No root cause details are provided beyond the XSS description in the ...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

EUVD-2026-49210

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236

The CVE concerns the Contact Form 7 WordPress plugin (pre-2.5) failing to validate the host of a user-supplied return URL before using it as the success and cancel redirect targets for a Stripe checkout. Root cause: lack of host validation on the return URL enables an unauthenticated attacker to ...