Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2023-1112)
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
PLUGIN
Contact Form 7
CVE-2023-1112
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Security Vulnerability (CVE-2021-24159)
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
PLUGIN
Contact Form 7
CVE-2021-24159
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2020-35489)
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
PLUGIN
Contact Form 7
CVE-2020-35489
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2020-12800)
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
PLUGIN
Contact Form 7
CVE-2020-12800
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Privilege Escalation (CVE-2018-20979)
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
PLUGIN
Contact Form 7
CVE-2018-20979
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Security Vulnerability (CVE-2018-9035)
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.
PLUGIN
Contact Form 7
CVE-2018-9035
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2015-2040)
Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
PLUGIN
Contact Form 7
CVE-2015-2040
Risk Score