CVE-2026-109218

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

CVE-2026-109218

The Contact Manager plugin for WordPress (versions up to and including 9.1.2 ) is vulnerable to Arbitrary File Upload via the add_message function. The root cause is an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation rou...

PT-2026-127859

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...