WordPress Contact Form 7 plugin < 2.5 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Pedro Antunes in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions 2.5...

CVE-2026-14236 Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236

The Contact Form 7 – PayPal & Stripe Add-on WordPress plugin (versions before 2.5 ) is vulnerable to an Open Redirect vulnerability. The root cause is a failure to validate the host of a user-supplied return URL, which is used as the success and cancel redirect targets during a Stripe checkout fl...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236 Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-59534: Missing Authorization

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-14236: URL Redirection to Untrusted Site

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

PT-2026-65317

Name of the Vulnerable Software and Affected Versions Message Filter for Contact Form 7 versions prior to 1.6.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

PT-2026-65318

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

CVE-2026-65438: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

PT-2026-64914

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65439: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

PT-2026-64929

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

PT-2026-65410

Name of the Vulnerable Software and Affected Versions WP Fast Total Search – The Power of Indexed Search versions prior to 1.80.281 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows...

PT-2026-64847

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

WordPress Divi Form Builder CVE-2026-5118 admin creation

CVE-2026-5118: Divi Form Builder = 5.1.2 accepts a client-supplied role on defbajaxsubmitajaxhandler during registration. Harvests fbnonce from the site, then POSTs multipart register with role=administrator to create an unauthenticated WordPress admin. Fixed in 5.1.3+. !/usr/bin/env python3 --...

WordPress Divi Form Builder CVE-2026-5118 detection

Detects Divi Engine Divi Form Builder and flags versions = 5.1.2 affected by CVE-2026-5118 unauthenticated admin creation via defbajaxsubmitajaxhandler role=administrator. Looks for fbnonce / defbobj markers and plugin assets. Fixed in 5.1.3+. !/usr/bin/env python3 -- coding: utf-8 --...

Denial Of Service (DoS)

pyasn1 is vulnerable to Denial Of Service DoS. The vulnerability is due to the BER decoder parsing long-form tags without limiting the tag identifier size, which allows an attacker to supply crafted ASN.1 input that causes excessive CPU consumption or triggers unhandled exceptions, resulting in a...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...

MAL-2026-11060 Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...