Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-80439

Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redirection-for-contact-form7 Wordpress
Products
Redirection For Contact Form 7 Wordpress
CVE-2021-36913

Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability

Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redirection-for-contact-form7
Products
Redirection For Contact Form 7
CVE-2022-0250

Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Redirection-for-contact-form7
Products
Redirection For Contact Form 7