Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-24
Contact Form Builder - Cross-Site Scripting (XSS) (CVE-2022-50959)
WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.
PLUGIN
Contact Form Builder
CVE-2022-50959
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Server-Side Request Forgery (SSRF) (CVE-2024-13450)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
PLUGIN
Contact Form Builder
CVE-2024-13450
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Remote Code Execution (CVE-2024-7782)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Contact Form Builder
CVE-2024-7782
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Remote Code Execution (CVE-2024-7777)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Contact Form Builder
CVE-2024-7777
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - SQL Injection (CVE-2024-7780)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Contact Form Builder
CVE-2024-7780
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Security Vulnerability (CVE-2024-7775)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
PLUGIN
Contact Form Builder
CVE-2024-7775
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - SQL Injection (CVE-2024-7702)
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the entryID parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Contact Form Builder
CVE-2024-7702
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Security Vulnerability (CVE-2024-35747)
Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.
PLUGIN
Contact Form Builder
CVE-2024-35747
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder Plugin - Security Vulnerability (CVE-2024-1640)
The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions.
PLUGIN
Contact Form Builder Plugin
CVE-2024-1640
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Security Vulnerability (CVE-2024-1218)
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
PLUGIN
Contact Form Builder
CVE-2024-1218
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Broken Access Control (CVE-2024-1217)
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
PLUGIN
Contact Form Builder
CVE-2024-1217
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Cross-Site Scripting (XSS) (CVE-2023-5048)
The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contact Form Builder
CVE-2023-5048
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Cross-Site Scripting (XSS) (CVE-2023-46075)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin
PLUGIN
Contact Form Builder
CVE-2023-46075
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Cross-Site Scripting (XSS) (CVE-2023-3645)
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Contact Form Builder
CVE-2023-3645
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form Builder - Path Traversal (CVE-2019-11557)
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
PLUGIN
Contact Form Builder
CVE-2019-11557
Risk Score