CVE-2024-3495-POC

CVE-2024-3495-POC The Country State City Dropdown CF7 WordPress plugin versions up to 2.7.2 is vulnerable to SQL Injection via 'cnt' and 'sid' parameters. Insufficient escaping and lack of preparation in the SQL query allow unauthenticated attackers to append queries, potentially extracting...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin CVE-2026-5718 — DnD CF7 File Upload RCE Scanner Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Plugin Slug: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS Score: 8...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364, Contact Form 7 के लिए Drag and Drop File Upload में एक CVSS 8.1 उच्च बिना प्रमाणीकरण वाली मनमानी फ़ाइल अपलोड भेद्यता है। CVE-2026-5364 — CF7 ड्रैग एंड ड्रॉप फ़ाइल अपलोड RCE sanitizefilename बाईपास के माध्यम से बिना प्रमाणीकरण के मनमानी फ़ाइल अपलोड CVSS 8.1 उच्च |...

CVE-2025-3515

CVE-2025-3515 - WordPress फ़ाइल अपलोड RCE उपयोग root@kitploit: python3 exploit.py अवलोकन CVE-2025-3515 "Drag and Drop Multiple File Upload for Contact Form 7" वर्डप्रेस प्लगइन में एक फ़ाइल अपलोड भेद्यता है जो बिना प्रमाणीकरण वाले हमलावरों को दुर्भावनापूर्ण फ़ाइलें अपलोड करने और रिमोट कोड निष्पादन...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

CVE-2026-10734

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

MINI-CF7V-M64R-GPR2

Bulletin has no description...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...

CVE-2026-59534 WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-65540

CVE-2026-65540 affects the WordPress plugin “Popup for CF7 with Sweet Alert” (versions &lt;= 1.6.5). The vulnerability is a reported unauthenticated Cross Site Request Forgery (CSRF) weakness in this plugin. The CVSS data indicate: AV:N, AC:L, PR:N, UI:R, S:C, C:L, I:L, A:L, base score 7.1 (HIGH)...

CVE-2026-27393

The CVE-2026-27393 entry concerns the WordPress plugin CF7 WOW Styler (versions n/a–1.7.6). The issue is described as a Missing Authorization / Broken Access Control vulnerability in which access permissions are incorrectly configured, allowing unauthorized access to functionality. The available ...

CVE-2026-27393

Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6...

CVE-2026-27393 WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6...

WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rapid0nion in WordPress Plugin CF7 WOW Styler versions = 1.7.6...

PT-2026-42434

Name of the Vulnerable Software and Affected Versions Tobias CF7 WOW Styler versions prior to 1.7.6 Description A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than 1.7.6...

WordPress plugin CF7 WOW Styler 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-0814

The CVE-2026-0814 entry concerns the WordPress plugin Advanced CF7 DB . A missing capability check in the function vsz_cf7_export_to_excel affects all versions up to and including 2.0.9 , enabling authenticated users with Subscriber-level access and above to export form submissions to Excel files...

CVE-2026-24991

Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through = 3.4.0...

CVE-2026-24991 WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through = 3.4.0...

CVE-2026-24991

Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through = 3.4.0...