CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin (versions through 1.0.4 ) is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of authorization and CSRF checks on a REST endpoint, combined with a failure to verify that the updated option belongs to the ...

fuxploider

fuxploider Fuxploider è uno strumento di penetration testing open source che automatizza il processo di rilevamento e sfruttamento delle vulnerabilità dei form di upload di file. Questo strumento è in grado di rilevare i tipi di file consentiti per l'upload e di determinare quale tecnica funzione...

CVE-2026-108705

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

EUVD-2026-96703

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108705

CordysCRM through version 1.9.3 is vulnerable to a missing authorization flaw in the POST /custom-form/data/import endpoint. This vulnerability allows authenticated, low-privileged users to import data into any custom form by specifying a customFormId . Attackers can upload Excel files using impo...

CVE-2026-84261: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-96227: Improper Neutralization of Input During Web Page Generation

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-108903: Reliance on Untrusted Inputs in a Security Decision

pH7Builder pH7 Social Dating CMS before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid. Attackers can load a CAPTCHA-free form like login or search, then submit its ID with...

CVE-2026-108705: Missing Authorization

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

PT-2026-110034

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Contact Form 7 WordPress plugin versions prior to 1.0.5 Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Si...

PT-2026-110030

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Contact Form 7 WordPress plugin versions prior to 1.0.5 Description The software lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if...

PT-2026-110213

Name of the Vulnerable Software and Affected Versions pH7Builder versions prior to 19.3.0 Description An issue exists that allows unauthenticated attackers to bypass CAPTCHA validation. By providing a client-chosen form ID to the isValid function within the PFBC Form class, attackers can skip...

CVE-2026-84254: Missing Authorization

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-62043

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...

CVE-2026-62043

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is affected by an unauthenticated Sensitive Data Exposure vulnerability in versions

CVE-2026-62043 WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...

EUVD-2026-96473

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...

CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...