Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler < 1.6.5 - Missing Authorization via Several AJAX Action

Description The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin CF7 WOW Styler versions = 1.6.4...

WordPress CF7 WOW Styler Plugin <= 1.6.4 is vulnerable to Broken Access Control

Software CF7 WOW Styler Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34826 Patch priority Medium CVSS severity Medium 6.3 Developer Tobias PSID 6b711e00da8c Credits Dhabaleshwar Das Required privile...

CF7 File Download – File Download for CF7 <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The CF7 File Download – File Download for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-33697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0...

CVE-2024-33697

CVE-2024-33697 is a Stored XSS in the CF7 File Download – File Download for CF7 plugin (Rimes Gold CF7 File Download). The connected Red Hat entry specifies the root cause as Improper Neutralization of Input During Web Page Generation and states that the vulnerability affects CF7 File Download – ...

CVE-2024-33697 WordPress CF7 File Download plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0...

CVE-2024-33697 WordPress CF7 File Download plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0...

WordPress CF7 File Download – File Download for CF7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software CF7 File Download – File Download for CF7 Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-33697 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 07cbdf580a98 Credits...

CVE-2023-41864

Cross-Site Request Forgery CSRF vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0...

CVE-2023-41864 WordPress PeproDev CF7 Database plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0...

CVE-2023-41864

Technical details for CVE-2023-41864 are not provided in the supplied documents; no affected products/versions or mitigations are specified here—monitor for updates.

CVE-2023-41864 WordPress PeproDev CF7 Database plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0...

WordPress Country State City Dropdown CF7 Plugin <= 2.7.1 is vulnerable to Broken Access Control

Software Country State City Dropdown CF7 Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3520 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bfcec957c70d Credits Lucio Sá...

WordPress PeproDev CF7 Database Plugin <= 1.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software PeproDev CF7 Database Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.9.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41864 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3d141a658694 Credits RE-ALTER...

CVE-2023-44989

Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5...

CVE-2023-44989

CVE-2023-44989 affects the CF7 Google Sheets Connector WordPress plugin. It enables unauthenticated exposure of sensitive data via the plugin’s debug log (google-sheet-connector.php) for versions up to 5.0.5. Patch: upgrade to 5.0.6. The CVSS/impact details in connected sources cite high severity...

CVE-2024-29102

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6...

CVE-2024-29102 WordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6...

CVE-2024-29102 WordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6...