CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remote code executio...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 es una vulnerabilidad de carga de archivos arbitraria no autenticada con CVSS 8.1 High en Drag and Drop File Upload for Contact Form 7 CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Carga de archivos arbitraria no autenticada mediante bypass desanitizefilename CVSS 8....

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Subida de archivos no autenticada a RCE en el plugin DnD Upload CF7 CVE-2026-5718 — Escáner de subida de archivos DnD CF7 a RCE Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Slug del plugin: drag-and-drop-multiple-file-upload-contact-form-7 ID CVE:...

CVE-2026-40807

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-40807

The CF7 Views – Complete Entry Management for Contact Form 7 plugin for WordPress, version 3.2.6 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. The issue is rooted in the improper neutralization of input during web page generation (CWE-79). Successful ex...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

EUVD-2026-93044

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

EUVD-2026-93253

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39731 WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39731

The Database for CF7 WordPress plugin versions

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

CVE-2024-3495-POC

CVE-2024-3495-POC El complemento Country State City Dropdown CF7 de WordPress versiones hasta 2.7.2 es vulnerable a inyección SQL a través de los parámetros 'cnt' y 'sid'. El escape insuficiente y la falta de preparación en la consulta SQL permiten a atacantes no autenticados añadir consultas,...

CVE-2026-62058

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

EUVD-2026-90810

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058

The WordPress CF7 Apps plugin (versions

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Romain Deperne in WordPress Plugin CF7 Apps versions = 3.7.2...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...