Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
Contact Form to Any API - Security Vulnerability (CVE-2026-18946)
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
PLUGIN
Contact Form to Any API
CVE-2026-18946
Risk Score
Threat Entry
Updated 2026-07-30
Contact Form To Any Api - Cross-Site Scripting (XSS) (CVE-2026-15735)
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contact Form To Any Api
CVE-2026-15735
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form to Any API - Cross-Site Scripting (XSS) (CVE-2026-39449)
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API
PLUGIN
Contact Form to Any API
CVE-2026-39449
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form To Any Api - Broken Access Control (CVE-2023-47871)
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
PLUGIN
Contact Form To Any Api
CVE-2023-47871
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form To Any Api - Cross-Site Scripting (XSS) (CVE-2024-7617)
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contact Form To Any Api
CVE-2024-7617
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form To Any Api - SQL Injection (CVE-2023-32741)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.
PLUGIN
Contact Form To Any Api
CVE-2023-32741
Risk Score