CVE-2026-112379 WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

CVE-2026-112379

The Codepeople Contact Form Email (contact-form-to-email) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.3.68 . The flaw stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious...

CVE-2026-39745

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

EUVD-2026-93254

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

CVE-2026-39745 WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

CVE-2026-39745

The Contact Form to DB by BestWebSoft plugin for WordPress, version 1.7.6 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. This issue stems from the improper neutralization of input during web page generation (CWE-79). The vulnerability allows an attacker ...

CVE-2026-39745 WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

CVE-2026-39745: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

PT-2026-106419

Name of the Vulnerable Software and Affected Versions Contact Form to DB versions prior to 1.7.7 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into the contact form...

WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin Contact Form to DB by BestWebSoft versions = 1.7.6...

CVE-2026-77773: Exposure of Sensitive Information to an Unauthorized Actor

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...

WordPress Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Contact Form to DB by BestWebSoft versions = 1.7.5...

CVE-2026-13359: Improper Neutralization of Input During Web Page Generation

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-18946 Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users...

PT-2026-69376

Name of the Vulnerable Software and Affected Versions Contact Form to Any API versions prior to 3.0.7 Description The plugin fails to use random filenames when copying files uploaded via contact forms into a publicly accessible directory. This allows unauthenticated attackers to enumerate and...

CVE-2026-18946: Exposure of Sensitive Information to an Unauthorized Actor

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users...

CVE-2026-15735 Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15735: Improper Neutralization of Input During Web Page Generation

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting Detection

WordPress Pondol Form to Mail 1.1 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...