CVE-2025-54020

CVE-2025-54020: CSRF in WordPress AntiSpam for Contact Form 7 (versions 0.6.3); CVSSv3.1 base score 5.4 (Medium). Exploitation details are not provided in the supplied documents; no specific in-the-wild exploit information is listed. Remediation: update to a version with the fix as indicated by r...

CVE-2025-54015 WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through = 2.0.0...

CVE-2025-54015 WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through = 2.0.0...

CVE-2025-54015

CVE-2025-54015 is a Local File Inclusion vulnerability in the WordPress plugin family HT Contact Form 7 (HT Plugins). The documented root cause is improper control of the filename used by PHP include/require, enabling PHP Local File Inclusion. Affected software: HT Contact Form 7 versions from n/...

WordPress plugin Multi-language Responsive Contact Form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

PT-2025-29783 · August Infotech · Multi-Language Responsive Contact Form

Name of the Vulnerable Software and Affected Versions: August Infotech Multi-language Responsive Contact Form versions through 2.8 Description: The Multi-language Responsive Contact Form software contains a missing authorization issue. Access to functionality is not properly constrained by Access...

WordPress plugin Pay with Contact Form 7 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Pay with Contact Form 7, which stems from improper input neutralization, and can be exploited by an attacker to...

PT-2025-29812 · Unknown · Cmsminds Pay With Contact Form 7

Name of the Vulnerable Software and Affected Versions: cmsMinds Pay with Contact Form 7 versions through 1.0.4 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicio...

WordPress plugin HT Contact Form 7 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A file inclusion vulnerability exists in WordPress HT Contact Form 7, which stems from improper file name control and can be exploited by an attacker to cause a PHP native...

PT-2025-29750 · WordPress · Antispam For Contact Form 7

Name of the Vulnerable Software and Affected Versions: AntiSpam for Contact Form 7 versions through 0.6.3 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their knowledge...

WordPress plugin AntiSpam for Contact Form 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-29747 · Unknown · Contact Form 7

Name of the Vulnerable Software and Affected Versions: HT Contact Form 7 versions n/a through 2.0.0 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion...

WordPress plugin Contact Form 7 Editor Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

PT-2025-29803 · Arisoft · Arisoft Contact Form 7 Editor Button

Name of the Vulnerable Software and Affected Versions: arisoft Contact Form 7 Editor Button versions through 1.0.0 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for potential malicious...

CVE-2025-7360

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handlefilesupload function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7360

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handlefilesupload function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7341

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the tempfiledelete function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7341

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the tempfiledelete function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7340

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the tempfileupload function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7340

The CVE-2025-7340 entry concerns the WordPress plugin HT Contact Form Widget for Elementor/Page Builder/Gutenberg Blocks (versions up to and including 2.2.1). The root cause is missing server-side file type validation in temp_fileUpload(), allowing unauthenticated users to trigger an upload via t...