CVE-2022-24087

CVE-2022-24087-RCE and CVE-2022-24086-RCE CVE description CVE-2022-24086 and CVE-2022-24087 - improper Input Validation vulnerability in contact form Magento Open Source and Adobe Commerce - has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means tha...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7 Description: Arbitrary file uploads via drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7 ≤1.3.8.9 allow upload of .phar files, leading to remote code execution in Apache+modphp :contentReferenceoaicite:29index=29...

Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 La CVE-2020-35489 se descubrió en el plugin de WordPress Contact Form 7 5.3.1 y versiones anteriores. Al explotar esta vulnerabilidad, los atacantes podían simplemente subir archivos de cualquier tipo, omitiendo todas las restricciones establecidas sobre los...

CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...

Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 The CVE-2020-35489 is discovered in the WordPress plugin Contact Form 7 5.3.1 and older versions. By exploiting this vulnerability, attackers could simply upload files of any type, bypassing all restrictions placed regarding the allowed upload-able file type...

CVE-2026-77773 Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

wp_CVE-2020-35489_checker

wpCVE-2020-35489checker CVE-2020-35489 - Introduction The wpCVE-2020-35489checker is a Python command-line tool designed to check if a WordPress website is vulnerable to CVE-2020-35489. This particular vulnerability stems from a security flaw in the WordPress Contact Form 7 plugin versions before...

CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage root@kitploit: python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remot...

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. id: CVE-2017-18491 info: name: Contact Form by BestWebSoft 4.0.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple X...

WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting

WordPress Contact Form 7 before 1.3.6.3 contains an unauthenticated stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload plugin. SVG files can be uploaded by default via the dndcodedropzupload AJAX action. id: CVE-2022-0595 info: name: WordPress Contact Form 7 1.3.6...

Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation

The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...

WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting

WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute. id: CVE-2022-2187 info: name: WordPress Contact Form 7 Captcha 0.1.2 - Cross-Site Scripting...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. id: CVE-2017-18492 info: name: Contact Form to DB by BestWebSoft 1.5.7 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-to-db plugin before 1.5.7 for WordPress has multip...

Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab Drag and Drop Multiple File Upload for Contact Form 7 Spin up a vulnerable WordPress environment to reproduce and validate CVE-2025-3515 — unrestricted file upload via ddmuuploadfile in the plugin drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8.9. This lab is...