4965 matches found
CVE-2023-0546
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to...
CVE-2023-25976
Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin = 1.2.2 versions...
CVE-2023-30493
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.2.0 versions...
CVE-2023-30495
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23...
CVE-2023-23885
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Contact Form plugin = 8.0.3.1 versions...
CVE-2023-50830
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue affects Seos Contact Form: from n/a through 1.8.0...
CVE-2023-45609
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in POWR.Io Contact Form – Custom Builder, Payment Form, and More allows Stored XSS.This issue affects Contact Form – Custom Builder, Payment Form, and More: from n/a through 2.1.0...
CVE-2023-6630
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for...
CVE-2023-33311
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in CRM Perks Contact Form Entries plugin = 1.3.0 versions...
CVE-2023-24420
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin = 1.1.1 versions...
CVE-2023-24405
Cross-Site Request Forgery CSRF vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin = 1.9.3 versions...
CVE-2023-46075
Unauth. Reflected Cross-Site Scripting XSS vulnerability in wpdevart Contact Form Builder, Contact Widget plugin = 2.1.6 versions...
CVE-2023-37988
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Creative Solutions Contact Form Generator plugin = 2.5.5 versions...
CVE-2023-22703
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Webcodin WCP Contact Form plugin = 3.1.0 versions...
CVE-2023-44231
Cross-Site Request Forgery CSRF vulnerability in NickDuncan Contact Form plugin = 2.0.10 versions...
CVE-2023-44265
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Popup contact form plugin = 7.1 versions...
CVE-2023-35910
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Nucleusgenius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0...
CVE-2023-35911
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Creative Solutions Contact Form Generator : Creative form builder for WordPress allows SQL Injection.This issue affects Contact Form Generator : Creative form builder for WordPress: from n/a throug...