Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Contact Form 7 - Security Vulnerability (CVE-2026-114432)
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the…
PLUGIN
Contact Form 7
CVE-2026-114432
Risk Score
Threat Entry
Updated 2026-11-07
Contact Form 7 - Security Vulnerability (CVE-2026-121768)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markus Wiesenhofer Contact Form 7 – Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 – Post Fields: from n/a through 2.6.0.
PLUGIN
Contact Form 7
CVE-2026-121768
Risk Score
Threat Entry
Updated 2026-10-30
Contact Form 7 - Security Vulnerability (CVE-2026-62057)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
PLUGIN
Contact Form 7
CVE-2026-62057
Risk Score
Threat Entry
Updated 2026-10-06
Contact Form 7 - Security Vulnerability (CVE-2026-40807)
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7
PLUGIN
Contact Form 7
CVE-2026-40807
Risk Score
Threat Entry
Updated 2026-09-30
Contact Form 7 - Security Vulnerability (CVE-2026-100513)
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7
PLUGIN
Contact Form 7
CVE-2026-100513
Risk Score
Threat Entry
Updated 2026-08-20
Contact Form 7 - Security Vulnerability (CVE-2026-73386)
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7
PLUGIN
Contact Form 7
CVE-2026-73386
Risk Score
Threat Entry
Updated 2026-08-12
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2026-5116)
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.
PLUGIN
Contact Form 7
CVE-2026-5116
Risk Score
Threat Entry
Updated 2026-07-27
Contact Form 7 - Improper Input Validation (CVE-2026-14236)
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.
PLUGIN
Contact Form 7
CVE-2026-14236
Risk Score
Threat Entry
Updated 2026-07-22
The Contact Form 7 - Security Vulnerability (CVE-2025-13146)
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.
PLUGIN
The Contact Form 7
CVE-2025-13146
Risk Score
Threat Entry
Updated 2026-07-13
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2026-57423)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-57423
Risk Score
Threat Entry
Updated 2026-07-13
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2026-57411)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views – Complete Entry Management for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-57411
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-9691)
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-9691
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49765)
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-49765
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49109)
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-49109
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49106)
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact
PLUGIN
Contact Form 7
CVE-2026-49106
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49105)
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-49105
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49104)
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-49104
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - PHP Object Injection (CVE-2026-49085)
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
PLUGIN
Contact Form 7
CVE-2026-49085
Risk Score
Threat Entry
Updated 2026-07-21
Contact Form 7 - Security Vulnerability (CVE-2026-9189)
The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and including, 2.4.9. Although `cf7pp_paypal_ipn_handler()` correctly validates IPN authenticity by posting back to PayPal with `cmd=_notify-validate`, it fails to compare the IPN payload's `mc_gross` (payment amount), `mc_currency`, or `receiver_email` fields against the corresponding stored order values before passing the attacker-controlled `invoice` field directly to `cf7pp_complete_payment()`, which marks the order completed after only an integer cast with no amount verification. This makes it…
PLUGIN
Contact Form 7
CVE-2026-9189
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2026-42728)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-42728
Risk Score