Contact Form Entries Security Vulnerabilities and Issues — Contact Form Entries CVE List

Lucene search

CrmperksContact Form Entries

3 matches found

CVE•added 2022/01/24 8:15 a.m.•48 views

CVE-2021-25079

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

6.1CVSS6.2AI score0.01946EPSS

CVE•added 2022/01/24 8:15 a.m.•43 views

CVE-2021-25080

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

6.1CVSS6AI score0.51607EPSS

CVE•added 2024/01/16 4:15 p.m.•40 views

CVE-2022-3604

The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.

7.8CVSS7.7AI score0.00294EPSS