WordPress plugin Professional Contact Form 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-10949

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

WordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Multilang Contact Form versions = 1.5...

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin W3SCloud Contact Form 7 to Zoho CRM versions = 3.2...

WordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability

Content Injection vulnerability discovered by Najib Sinjari in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...

CVE-2025-60169

Cross-Site Request Forgery CSRF vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through = 3.2...

CVE-2025-60169 WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through = 3.2...

CVE-2025-10987

A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate t...

CVE-2025-10987

YunaiV yudao-cloud (HTTP Request Handler) is affected by CVE-2025-10987 due to improper authorization in the /crm/contact/transfer file where the contactId parameter can be manipulated. The issue enables a remote attack and has publicly disclosed exploits. Multiple feeds confirm the vulnerability...

PT-2025-39610

Name of the Vulnerable Software and Affected Versions W3SCloud Contact Form 7 to Zoho CRM versions through 3.0 Description A Cross-Site Request Forgery CSRF issue exists in W3SCloud Contact Form 7 to Zoho CRM, which may also lead to Stored Cross-Site Scripting XSS. The issue allows attackers to...

WordPress plugin W3SCloud Contact Form 7 to Zoho CRM 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site request forgery...

yudao-cloud 授权问题漏洞

yudao-cloud is a backend management system for YunaiV individual developers. An authorization issue vulnerability exists in yudao-cloud version 2025.09 and earlier, which stems from improper authorization of the parameter contactId in the file /crm/contact/transfer, which could lead to remote...

Malicious code in @sev-ui-verse/contact-models (npm)

The package @sev-ui-verse/contact-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eafe3e022be23739d479cdfe1e577a7e5b593a528063ce67b8fa1beb911fb2e0 Any computer that has this package installed or running should be considere...

MAL-2025-47532 Malicious code in @sev-ui-verse/contact-models (npm)

The package @sev-ui-verse/contact-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eafe3e022be23739d479cdfe1e577a7e5b593a528063ce67b8fa1beb911fb2e0 Any computer that has this package installed or running should be considere...

Jeep and Dodge Parent Company Stellantis Confirms Customer Data Breach

Stellantis, parent of Jeep, Chrysler, Dodge and FIAT, confirms data breach through third-party vendor. Contact info exposed, financial data not affected...

CVE-2025-58016 WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through = 0.26...

CVE-2025-58016

CVE-2025-58016 affects CF7 Submissions (WordPress plugin). The vulnerability is Missing Authorization due to misconfigured access control levels, with a CVSS v3.1 base score of 4.3 (Medium) and an observation that exploitation could occur without user interaction. Connected documents confirm the ...

CVE-2025-59411 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user...

CVE-2025-59411 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user...

CVE-2025-59411

CVE-2025-59411 affects CubeCart versions prior to 6.5.11. The Enquiry field in the contact form accepts raw HTML, which is included verbatim in emails to the store admin, indicating a lack of escaping/sanitization before output in email (and possibly on re-render). This creates a Cross‑Site Scrip...