33641 matches found
PT-2026-110030
Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Contact Form 7 WordPress plugin versions prior to 1.0.5 Description The software lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if...
PT-2026-110213
Name of the Vulnerable Software and Affected Versions pH7Builder versions prior to 19.3.0 Description An issue exists that allows unauthenticated attackers to bypass CAPTCHA validation. By providing a client-chosen form ID to the isValid function within the PFBC Form class, attackers can skip...
CVE-2026-84254: Missing Authorization
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...
CVE-2026-62043
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...
CVE-2026-62043
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is affected by an unauthenticated Sensitive Data Exposure vulnerability in versions
CVE-2026-62043 WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...
EUVD-2026-96473
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...
CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657
The HivePress WordPress plugin (versions ≤ 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the < parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For the vulnerability to be ex...
CVE-2026-101921
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...
EUVD-2026-96278
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...
CVE-2026-105989
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...
CVE-2026-105990
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
CVE-2026-105989
The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions before 4.0.7 , is vulnerable to unauthenticated transaction status forgery. The root cause is a lack of authorization and request-validation checks on one of its AJAX actions. This allows an unauthenticated attacker to ...
EUVD-2026-96123
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...
CVE-2026-105990
The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7 , is vulnerable to an unauthenticated PII disclosure . The root cause is a lack of authorization checks when exporting stored form submissions. This flaw allows unauthenticated attackers to download sensi...
EUVD-2026-96124
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
CVE-2026-105989 Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...
CVE-2026-105990 Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
EUVD-2026-96113
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...