CVE-2024-1777

CVE-2024-1777 concerns the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability is a Cross-Site Request Forgery (CSRF) caused by missing or incorrect nonce validation on the plugin’s settings update function, enabling unauthenticated attackers to alter plugin settings ...

CVE-2024-1778

CVE-2024-1778 affects the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability is due to a missing capability check in the zt_dcfcf_change_bookmark() function, enabling unauthenticated actors to modify bookmark statuses in all versions up to 1.1.1. Multiple connected s...

CVE-2024-1779

CVE-2024-1779 affects the WordPress plugin “Admin side data storage for Contact Form 7.” The vulnerability stems from a missing capability check in the zt_dcfcf_change_status() function, allowing unauthenticated attackers to modify the read-status of messages. All versions up to and including 1.1...

CVE-2024-1776

The CVE-2024-1776 entry concerns the Admin side data storage for the WordPress plugin Contact Form 7. Affected versions are all up to 1.1.1. Root cause: insufficient escaping of the user-supplied form-id parameter and inadequate preparation in the existing SQL query, enabling an authenticated att...

CVE-2023-24420

CVE-2023-24420 affects the WordPress plugin Admin side data storage for Contact Form 7 (<= 1.1.1). The vulnerability is unauthenticated, allows reflected XSS in the admin-side data storage feature. Root cause is an unauthenticated input handling flaw leading to cross-site scripting. Affected p...