CVE-2022-3634

Affects WordPress Contact Form 7 Database Addon plugin for WordPress (versions prior to 1.2.6.5). The vulnerability arises because the plugin does not validate data when exporting to CSV, enabling CSV injection. CVSS v3.1 base score 9.8 (CRITICAL). Remediation: update to version 1.2.6.5 or later....

CVE-2021-24144

The CVE-2021-24144 issue affects the WordPress plugin Contact Form 7 Database Addon (CFDB7). Unvalidated input in CFDB7 prior to version 1.2.5.6 allows injection of arbitrary formulas into CSV exports/files. Affected component: CFDB7 CSV export handling; root cause: input validation weakness lead...

CVE-2021-36886

CVE-2021-36886 affects the WordPress plugin Contact Form 7 Database Addon (CFDB7) versions up to 1.2.5.9. Root cause is CSRF due to lack of token validation, enabling unauthorized actions when a logged-in user visits a malicious page. Impact is CSRF risk on sites using CFDB7

CVE-2021-36885

CFDB7 (Contact Form 7 Database Addon) WordPress plugin versions

CVE-2025-6740

CVE-2025-6740 concerns the WordPress plugin Contact Form 7 Database Addon (CFDB7). It is documented as vulnerable to unauthenticated stored cross-site scripting via the tmpD parameter in all versions up to and including 1.3.1, due to insufficient input sanitization and output escaping. The vulner...