Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2022-0248

Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Contact Form Submissions Project
Products
Contact Form Submissions
CVE-2021-24125

Contact Form Submissions < 1.7.1 - Authenticated SQL Injection

Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Contact Form Submissions Project
Products
Contact Form Submissions