EUVD-2026-49664

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

EUVD-2026-49663

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65439

The CVE-2026-65439 entry describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Ultimate Addons for Contact Form 7” affecting versions

CVE-2026-65439

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65438

CVE-2026-65438 affects the WordPress plugin “Message Filter for Contact Form 7” (versions up to 1.6.3.9). The issue is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the plugin’s message filtering functionality. No root cause details are provided beyond the XSS description in the ...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

EUVD-2026-49210

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-59534 WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

EUVD-2026-49198

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...