4947 matches found
CVE-2021-24777
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the subid parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection...
CVE-2021-24777
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the subid parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection...
Sql injection
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the subid parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection...
CVE-2021-24777 Hotscot Contact Form < 1.3 - Admin+ SQL Injection
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the subid parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection...
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
The plugin allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip...
WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Brandon James Roldan in WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin versions = 1.3.6.2. Solution Update the WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest...
WordPress的Hotscot Contact Form插件 SQL注入漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in WordPress Hotscot Contact Form, which stems from a view submission featu...
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
The plugin allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip,...
WordPress Drag & Drop Contact Form Plugin Arbitrary File Download Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in Wordpress Drag & Drop Contact Form Plugin 1.0.5 and earlier...
CVE-2021-24689
CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...
WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin < 1.4.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin versions 1.4.2. Solution Update the WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin to the latest available version at...
WordPress Rate limiting for Contact Form 7 plugin < 1.0.4 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Rate limiting for Contact Form 7 plugin versions 1.0.4. Solution Update the WordPress Rate limiting for Contact Form 7 plugin to the latest available version at least 1.0.4...
WordPress Quick Contact Form plugin < 8.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Quick Contact Form plugin versions 8.0.2. Solution Update the WordPress Quick Contact Form plugin to the latest available version at least 8.0.2...
WordPress Redirection for Contact Form 7 plugin < 2.5.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Redirection for Contact Form 7 plugin versions 2.5.0. Solution Update the WordPress Redirection for Contact Form 7 plugin to the latest available version at least 2.5.0...
WordPress Streak CRM For Gmail For Contact Form 7 – WordPress Plugin plugin <= 1.0.8 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Streak CRM For Gmail For Contact Form 7 – WordPress Plugin plugin versions = 1.0.8. Solution No patched version available...
WordPress Floating Contact Form & Social Chat for WordPress – SupportBubble plugin <= 1.3.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Floating Contact Form & Social Chat for WordPress – SupportBubble plugin versions = 1.3.3. Solution No patched version available...
WordPress Quick Contact Form plugin < 8.0.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Quick Contact Form plugin versions 8.0.2. Solution Update the WordPress Quick Contact Form plugin to the latest available version at least 8.0.2...
WordPress Contact Form 7 Multi-Step Forms plugin < 4.1.91 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Contact Form 7 Multi-Step Forms plugin versions 4.1.91. Solution Update the WordPress Contact Form 7 Multi-Step Forms plugin to the latest available version at least 4.1.91...
WordPress Table & Contact Form 7 Database – Tablesome – Data Table & Contact Form 7 Database (CFDB7) Plugin plugin < 0.6.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Table & Contact Form 7 Database – Tablesome – Data Table & Contact Form 7 Database CFDB7 Plugin plugin versions 0.6.7. Solution Update the WordPress Table & Contact Form 7 Database – Tablesome – Data...
WordPress Redirection for Contact Form 7 plugin < 2.5.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Redirection for Contact Form 7 plugin versions 2.5.0. Solution Update the WordPress Redirection for Contact Form 7 plugin to the latest available version at least 2.5.0...