CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3715 – Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-3715
22 Apr 2024 — The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Database for Contact Form 7, WPforms, Elementor forms para WordPress es vulnerable a Cross-Site Scripting Almacena... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074165%40contact-form-entries%2Ftrunk&old=3066269%40contact-form-entries%2Ftrunk&sfp_email=&sfph_mail= • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2030 – Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
https://notcve.org/view.php?id=CVE-2024-2030
06 Mar 2024 — The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Database for ... • https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/contact-form-entries.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1069 – Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2024-1069
30 Jan 2024 — The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. El complemento Contact Form Entries para WordPress es vulnerable a cargas de archivos arbitrarios debido a una validaci... • https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/includes/plugin-pages.php?rev=3003884#L1213 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31212 – WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2023-31212
22 May 2023 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0. Neutralización Inadecuada de Elementos Especiales utilizados en una vulnerabilidad de comando SQL ('Inyección SQL') en el CRM Perks Database para Contact Form 7, WPforms, Elementor forms contact-form-entrie... • https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-auth-sql-injection-sqli-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31095 – WordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection
https://notcve.org/view.php?id=CVE-2023-31095
26 Apr 2023 — URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8. Vulnerabilidad de redirección de URL a sitio no confiable ("Open Redirect") en CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. Este problema afecta a Integration for HubSpot and Contact Form 7, WPFo... • https://patchstack.com/database/vulnerability/cf7-hubspot/wordpress-integration-for-contact-form-7-hubspot-plugin-1-2-8-open-redirection-vulnerability?_s_id=cve • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3604 – Contact Form Entries < 1.3.0 - CSV Injection
https://notcve.org/view.php?id=CVE-2022-3604
21 Oct 2022 — The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. El complemento de WordPress Contact Form Entries anterior a 1.3.0 no valida los datos cuando se generan en un archivo CSV, lo que podría provocar una inyección de CSV. The Contact Form Entries plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.2.9 when outputting to a CSV file. This allows low-level attackers to embed untrusted i... • https://wpscan.com/vulnerability/300ebfcd-c500-464e-b919-acfeb72593de • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •