6222 matches found
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...
Cross site scripting
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...
CVE-2021-36886
CVE-2021-36886 affects the WordPress plugin Contact Form 7 Database Addon (CFDB7) versions up to 1.2.5.9. Root cause is CSRF due to lack of token validation, enabling unauthorized actions when a logged-in user visits a malicious page. Impact is CSRF risk on sites using CFDB7
CVE-2021-36885
CFDB7 (Contact Form 7 Database Addon) WordPress plugin versions
WordPress plugin cross-site request forgeing vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Contact Form 7 Database...
WordPress plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Contact Form 7 Database Addon CFDB7...
WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.6.7 - Arbitrary Lead Deletion vulnerability
Arbitrary Lead Deletion vulnerability discovered by WPScanTeam in WordPress Contact Form & Lead Form Elementor Builder plugin versions = 1.6.7. Solution Update the WordPress Contact Form & Lead Form Elementor Builder plugin to the latest available version at least 1.6.8...
PT-2021-21396 · WordPress · Contact Form 7 Database Addon – Cfdb7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9 Description: A Cross-Site Request Forgery CSRF issue was found in the Contact Form 7 Database Addon – CFDB7 WordPress plugin. This type of issue allows an attacker to...
PT-2021-21395 · WordPress · Contact Form 7 Database Addon
Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1 Description: The issue is related to an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. Recommendations: For versions = 1.2.6.1, update to a version high...
CVE-2021-36886: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...
CVE-2021-36885: Improper Neutralization of Input During Web Page Generation
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...
CVE-2021-24907
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
Cross site scripting
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24907
CVE-2021-24907 affects the WordPress Everest Forms plugin (versions before 1.8.0). The issue is a Reflected Cross-Site Scripting vulnerability caused by the plugin failing to escape the status parameter before outputting it in an attribute. Impact is XSS in contexts using that parameter; exploita...
PT-2021-16362
Name of the Vulnerable Software and Affected Versions: The Contact Form, Drag and Drop Form Builder for WordPress plugin versions prior to 1.8.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the status parameter is not properly escaped before bei...
CVE-2021-24907: Improper Neutralization of Input During Web Page Generation
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24790
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its deletecf7data and exportcf7data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The...
Cross site request forgery (csrf)
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its deletecf7data and exportcf7data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The...
CVE-2021-24790
The CVE pertains to the WordPress plugin Contact Form Advanced Database (versions ≤ 1.0.8). The vulnerability arises from missing authorization checks and CSRF protection in two AJAX endpoints, delete_cf7_data and export_cf7_data, which are accessible to any authenticated user (down to subscriber...
PT-2021-16285 · WordPress · Contact Form Advanced Database
Name of the Vulnerable Software and Affected Versions: Contact Form Advanced Database WordPress plugin versions 1.0.8 and earlier Description: The issue concerns the lack of authorization and CSRF checks in the delete cf7 data and export cf7 data AJAX actions, which are accessible to any...