Updated 6 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

787 results · page 8 of 16

Mar 27, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-30863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.
Product
Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Contact Form III: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through <= 1.6.2d.
Product
WP Contact Form III
Affected
up to 1.6.2d
What to do
Affects up to 1.6.2d. Update WP Contact Form III to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025UTM tags tracking for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracking allows Reflected XSS.This issue affects UTM tags tracking for Contact Form 7: from n/a through <= 2.1.
Product
UTM tags tracking for Contact Form 7
Affected
up to 2.1
What to do
Affects up to 2.1. Update UTM tags tracking for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Contact Form 7 Material Design: Cross-Site Request Forgery (CSRF)CVE-2025-30522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.
Product
Contact Form 7 Material Design
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Material Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2025Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: IP Address SpoofingCVE-2024-13666 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Stored Cross-Site ScriptingCVE-2024-13497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Sensitive Information ExposureCVE-2024-13498 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.8.1
What to do
Affects up to 8.8.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Contact Form 7 Select Box Editor Button: Cross-Site Request Forgery (CSRF)CVE-2025-28902 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through <= 0.6.
Product
Contact Form 7 Select Box Editor Button
Affected
up to 0.6
What to do
Affects up to 0.6. Update Contact Form 7 Select Box Editor Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Builder for Contact Form 7 by Webconstruct: Cross-Site Request Forgery (CSRF)CVE-2025-28864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.
Product
Builder for Contact Form 7 by Webconstruct
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Builder for Contact Form 7 by Webconstruct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-0469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.39.2
What to do
Affects up to 1.39.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 25, 2025Easy Contact Form Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26962 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through <= 1.1.25.
Product
Easy Contact Form Lite
Affected
up to 1.1.25
What to do
Affects up to 1.1.25. Update Easy Contact Form Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
Product
Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.0.9.4
What to do
Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 24, 2025Contact Form 7 Star Rating with font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27304 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through <= 1.3.
Product
Contact Form 7 Star Rating with font Awesome
Affected
up to 1.3
What to do
Affects up to 1.3. Update Contact Form 7 Star Rating with font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Contact Form 7 Star Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27303 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-star-rating allows Stored XSS.This issue affects Contact Form 7 Star Rating: from n/a through <= 1.10.
Product
Contact Form 7 Star Rating
Affected
up to 1.10
What to do
Affects up to 1.10. Update Contact Form 7 Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Contact Form With Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through <= 4.2.5.
Product
Contact Form With Shortcode
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Contact Form With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Advanced Angular Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.
Product
Advanced Angular Contact Form
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Angular Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Contact Form 7 – Paystack Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paystack-add-on allows Reflected XSS.This issue affects Contact Form 7 – Paystack Add-on: from n/a through <= 1.2.3.
Product
Contact Form 7 – Paystack Add-on
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Contact Form 7 – Paystack Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 5, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Sensitive Information ExposureCVE-2024-13829 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.8
What to do
Affects up to 8.0.8. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2024-13403 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Affected
up to 1.9.3.1
What to do
Affects up to 1.9.3.1. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025WordPress Contact Forms by Cimatti: Unauthorized access of dataCVE-2024-12184 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
Product
WordPress Contact Forms by Cimatti
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Drag and Drop Multiple File Upload – Contact Form 7: Limited arbitrary file deletionCVE-2024-12267 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.8.5
What to do
Affects up to 1.3.8.5. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025Contact Form and Calls To Action by vcita: Unauthorized modification of dataCVE-2024-13717 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to enabled and disable widgets.
Product
Contact Form and Calls To Action by vcita
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Contact Form and Calls To Action by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025Contact Form and Calls To Action by vcita: Stored Cross-Site ScriptingCVE-2024-11886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form and Calls To Action by vcita
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Contact Form and Calls To Action by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Reflected Cross-Site ScriptingCVE-2025-0470 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.38.2
What to do
Affects up to 1.38.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025The Contact Form & SMTP Plugin for WordPress by PirateForms: Arbitrary shortcode executionCVE-2024-13453 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Contact Form & SMTP Plugin for WordPress by PirateForms
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update The Contact Form & SMTP Plugin for WordPress by PirateForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025CP Contact Form with PayPal: Cross-Site Request ForgeryCVE-2024-13758 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_actions() function. This makes it possible for unauthenticated attackers to add discount codes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CP Contact Form with PayPal
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update CP Contact Form with PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-13470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.8.24
What to do
Affects up to 3.8.24. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-dynamics-crm allows Reflected XSS.This issue affects WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.6.
Product
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 25, 2025Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Server-Side Request ForgeryCVE-2024-13450 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Affected
up to 2.17.4
What to do
Affects up to 2.17.4. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025WP Contact Form7 Email Spam Blocker: Reflected Cross-Site ScriptingCVE-2024-13467 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Contact Form7 Email Spam Blocker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Contact Form7 Email Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 24, 2025Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
Product
Contact Form Email
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025HT Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24726 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
Product
HT Contact Form 7
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Product
Booking Calendar Contact Form
Affected
up to 1.2.55
What to do
Affects up to 1.2.55. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23812 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows Reflected XSS.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.
Product
Contact Form 7 Round Robin Lead Distribution
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Contact Form 7 Round Robin Lead Distribution: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23784 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.
Product
Contact Form 7 Round Robin Lead Distribution
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Contact Form 7 Round Robin Lead Distribution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Contact Form 7 Anti Spambot: Missing AuthorizationCVE-2025-23862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through <= 1.0.1.
Product
Contact Form 7 Anti Spambot
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Contact Form 7 Anti Spambot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Contact Form 7 – CCAvenue Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through <= 1.0.
Product
Contact Form 7 – CCAvenue Add-on
Affected
up to 1.0
What to do
Affects up to 1.0. Update Contact Form 7 – CCAvenue Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Multilang Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.
Product
Multilang Contact Form
Affected
up to 1.5
What to do
Affects up to 1.5. Update Multilang Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Ajax Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through <= 1.4.1.
Product
Ajax Contact Form
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Contact Form 7 Redirect & Thank You Page: Reflected Cross-Site ScriptingCVE-2024-12423 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Contact Form 7 Redirect & Thank You Page
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Contact Form 7 Redirect & Thank You Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2025Contact Form Master: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12587 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Contact Form Master
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Contact Form Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder: Stored Cross-Site ScriptingCVE-2024-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping and missing authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Contact Form 7 Database – CFDB7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.
Product
Contact Form 7 Database – CFDB7
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Database – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
Product
Contact Form by WPForms
Affected
up to 1.9.2.2
What to do
Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2025The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler: Arbitrary shortcode executionCVE-2024-12419 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. Version 1.7.0 patched the Reflected XSS issue, however, the arbitrary shortcode execution issue remains.
Product
The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2023-47693 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.2.6.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Contact Form, Survey & Form Builder – MightyForms: Missing AuthorizationCVE-2024-56002 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through <= 1.3.9.
Product
Contact Form, Survey & Form Builder – MightyForms
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.