Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-85117

Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Contact Form 7 Captcha Project Wordpress
Products
Contact Form 7 Captcha Wordpress
CVE-2022-2187

Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Contact Form 7 Captcha Project
Products
Contact Form 7 Captcha
CVE-2021-24565

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Contact Form 7 Captcha Project
Products
Contact Form 7 Captcha