CVE-2024-3495-POC

CVE-2024-3495-POC The Country State City Dropdown CF7 WordPress plugin versions up to 2.7.2 is vulnerable to SQL Injection via 'cnt' and 'sid' parameters. Insufficient escaping and lack of preparation in the SQL query allow unauthenticated attackers to append queries, potentially extracting...

CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remote code executio...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 is a CVSS 8.1 High Unauthenticated Arbitrary File Upload vulnerability in the Drag and Drop File Upload for Contact Form 7 CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Unauthenticated Arbitrary File Upload viasanitizefilename Bypass CVSS 8.1 High | Affected: = 1.1.3...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin CVE-2026-5718 — DnD CF7 File Upload RCE Scanner Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Plugin Slug: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS Score: 8...

CVE-2026-40807

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-40807

The CF7 Views – Complete Entry Management for Contact Form 7 plugin for WordPress, version 3.2.6 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. The issue is rooted in the improper neutralization of input during web page generation (CWE-79). Successful ex...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

EUVD-2026-93044

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

EUVD-2026-93253

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39731 WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39731

The Database for CF7 WordPress plugin versions

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

CVE-2026-62058

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

EUVD-2026-90810

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058

The WordPress CF7 Apps plugin (versions

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Romain Deperne in WordPress Plugin CF7 Apps versions = 3.7.2...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...