Updated 11 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

758 results · page 13 of 16

Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
Fixed in
3.0
What to do
Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2023Track Geolocation Of Users Using Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49188 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0.
Product
Track Geolocation Of Users Using Contact Form 7
Affected
up to 2.0
What to do
Affects up to 2.0. Update Track Geolocation Of Users Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Ultimate Addons for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.2.0.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Email
Fixed in
1.3.44
What to do
Update Contact Form Email to 1.3.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 7, 2023Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-47779 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
Product
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Ninja Forms Contact Form – The Drag and Drop Form Builder for: Uncontrolled Resource ConsumptionCVE-2023-35909 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor: Does not have CSRF checks on some of its form actions suchCVE-2023-5990 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor
Fixed in
3.4.2
What to do
Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023BSK Contact Form 7 Blacklist: Does not sanitise and escape the inserted_count parameter before outputting it back in the pageCVE-2023-5141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
BSK Contact Form 7 Blacklist
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update BSK Contact Form 7 Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 1, 2023Contact Form 7: Arbitrary file uploadsCVE-2023-6449 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion.
Product
Contact Form 7
Affected
up to 5.8.3
What to do
Affects up to 5.8.3. Update Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record contactform7.com github.com
Nov 30, 2023Contact Form – Custom Builder, Payment Form, and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POWR.Io Contact Form – Custom Builder, Payment Form, and More allows Stored XSS.This issue affects Contact Form – Custom Builder, Payment Form, and More: from n/a through 2.1.0.
Product
Contact Form – Custom Builder, Payment Form, and More
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Contact Form – Custom Builder, Payment Form, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2023-5822 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types.
Product
Drag and Drop Multiple File Upload - Contact Form 7
Affected
up to 1.3.7.3
What to do
Affects up to 1.3.7.3. Update Drag and Drop Multiple File Upload - Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.CVE-2023-47230 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Form Builder | Create Responsive Contact Forms: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23796 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
Product
Form Builder | Create Responsive Contact Forms
Affected
up to 1.9.9.0
What to do
Affects up to 1.9.9.0. Update Form Builder | Create Responsive Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Product
Ninja Forms Contact Form
Fixed in
3.6.34
What to do
Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD record ninjaforms.com wpscan.com
Nov 6, 2023Contact form 7 Custom validation: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40609 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.
Product
Contact form 7 Custom validation
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Contact form 7 Custom validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Contact Form Generator : Creative form builder for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-35911 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form builder for WordPress allows SQL Injection.This issue affects Contact Form Generator : Creative form builder for WordPress: from n/a through 2.6.0.
Product
Contact Form Generator : Creative form builder for
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Contact Form Generator : Creative form builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Quasar form free – Contact Form Builder for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-35910 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0.
Product
Quasar form free – Contact Form Builder for
Affected
up to 6.0
What to do
Affects up to 6.0. Update Quasar form free – Contact Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Contact Form to Any API: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32741 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.
Product
Contact Form to Any API
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com patchstack.com
Oct 31, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36508 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Database for Contact Form 7, WPforms, Elementor forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-24410 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.
Product
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Affected
up to 4.3.25
What to do
Affects up to 4.3.25. Update Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Contact form Form For All: Stored Cross-Site ScriptingCVE-2023-5337 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact form Form For All
Affected
up to 1.2
What to do
Affects up to 1.2. Update Contact form Form For All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023Interactive Contact Form and Multi Step Form Builder: Does not sanitise and escape some parametersCVE-2023-4950 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
Product
Interactive Contact Form and Multi Step Form Builder
Fixed in
3.4
What to do
Update Interactive Contact Form and Multi Step Form Builder to 3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions.CVE-2023-45647 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions.
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions.CVE-2023-45068 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions.
Affected
up to 1.7.27
What to do
Affects up to 1.7.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Slick Contact Forms: Stored Cross-Site ScriptingCVE-2023-5468 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slick Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcscf-link' shortcode in versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slick Contact Forms
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Slick Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.CVE-2023-44231 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 23, 2023Contact Form by FormGet: Stored Cross-Site ScriptingCVE-2023-5125 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form by FormGet
Affected
up to 5.5.5
What to do
Affects up to 5.5.5. Update Contact Form by FormGet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2023Ninja Forms WordPress Ninja Forms Contact Form: Was affected by a HTML Injection security vulnerabilityCVE-2023-4109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
Product
Ninja Forms WordPress Ninja Forms Contact Form
Fixed in
3.6.26
What to do
Update Ninja Forms WordPress Ninja Forms Contact Form to 3.6.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Contact Form Builder by Bit Form: Does not sanitise and escape some of its settingsCVE-2023-3645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Builder by Bit Form
Fixed in
2.2.0
What to do
Update Contact Form Builder by Bit Form to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2803 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Ultimate Addons for Contact Form 7
Fixed in
3.1.29
What to do
Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape some of its settingsCVE-2023-2802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Addons for Contact Form 7
Fixed in
3.1.29
What to do
Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023All-in-one Floating Contact Form: Does not sanitise and escape some of its settingsCVE-2023-3248 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
All-in-one Floating Contact Form
Fixed in
2.1.2
What to do
Update All-in-one Floating Contact Form to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2023Metform Elementor Contact Form Builder: Cross-Site Request ForgeryCVE-2023-2517 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structure via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While nonce verification is implemented, verification only takes place when a nonce is provided.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Forminator – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2021-4417 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthenticated attackers to export form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Forminator – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.13.4
What to do
Affects up to 1.13.4. Update Forminator – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.CVE-2023-24405 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
Fixed in
1.9.4
What to do
Update the plugin to 1.9.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.CVE-2023-24395 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.
Fixed in
1.0.4
What to do
Update the plugin to 1.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023Contact Form 7 Style: Cross-Site Request ForgeryCVE-2021-4390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This makes it possible for unauthenticated attackers to quick edit templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Contact Form 7 Style
Affected
up to 3.2
What to do
Affects up to 3.2. Update Contact Form 7 Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 26, 2023Eric Martin SimpleModal Contact Form: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-29438 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions.
Product
Eric Martin SimpleModal Contact Form
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Eric Martin SimpleModal Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Integration for Contact Form 7 and Zoho CRM, Bigin
Fixed in
1.2.4
What to do
Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2023WordPress Contact Forms by Cimatti: Cross-Site Request ForgeryCVE-2023-2563 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to missing or incorrect nonce validation on the function _accua_forms_form_edit_action. This makes it possible for unauthenticated attackers to delete forms created with this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WordPress Contact Forms by Cimatti
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2023Contact Form Email: Does not escape submitted values before displaying them in the HTMLCVE-2023-2718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
Product
Contact Form Email
Fixed in
1.3.38
What to do
Update Contact Form Email to 1.3.38 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Ultimate Addons for Contact Form 7: SQL InjectionCVE-2023-1615 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: CSV injectionCVE-2023-0721 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissionsCVE-2023-0710 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissionsCVE-2023-0709 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissionsCVE-2023-0708 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissionsCVE-2023-0695 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.