CVE-2024-37555 – WordPress Generate PDF using Contact Form 7 plugin <= 4.0.6 - Arbitrary File Upload vulnerability
https://notcve.org/view.php?id=CVE-2024-37555
09 Jul 2024 — Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7.This issue affects Generate PDF using Contact Form 7: from n/a through 4.0.6. Carga sin restricciones de archivos con vulnerabilidad de tipo peligroso en ZealousWeb Generate PDF usando el Contact Form 7. Este problema afecta a Generate PDF usando Contact Form 7: desde n/a hasta 4.0.6. • https://patchstack.com/database/vulnerability/generate-pdf-using-contact-form-7/wordpress-generate-pdf-using-contact-form-7-plugin-4-0-6-arbitrary-file-upload-vulnerability?_s_id=cve • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVE-2023-49188 – WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-49188
29 Nov 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 1.4. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en ZealousWeb Track Geolocation Of Users Using Contact Form 7 permite almacenar XSS. Este problema afecta a Track Geoloc... • https://patchstack.com/database/vulnerability/track-geolocation-of-users-using-contact-form-7/wordpress-track-geolocation-of-users-using-contact-form-7-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2022-3070 – Generate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3070
31 Aug 2022 — The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El plugin Generate PDF de WordPress versiones anteriores a 3.6, no sanea ni escapa de su configuración, lo que permite a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabil... • https://wpscan.com/vulnerability/cd8d71d1-030e-4ad4-866e-75d242883c6c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •