EUVD-2026-62387

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73384

Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379 WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

EUVD-2026-60794

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Affected component: Contact Form by Supsystic plugin for WordPress, versions before 1.10.0. Vulnerability type: Unauthenticated bypass, allowing network-accessible attackers to circumvent access controls without credentials. CVSS 3.1: 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Exploitation...

CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...

EUVD-2026-60793

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-66639

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

EUVD-2026-60924

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.5...

WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

CVE-2026-14484 RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...