Extension WordPress
Vulnérabilités Database for Contact Form 7, WPforms, Elementor forms
Cette page rassemble les failles publiées pour Database for Contact Form 7, WPforms, Elementor forms, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Database for Contact Form 7, WPforms, Elementor forms
17 fiches
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 – Unauthenticated Stored Cross-Site Scripting
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for…
*-1.5.2
1.5.3
10/07/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object…
*-1.5.1
1.5.2
01/07/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes…
*-1.5.1
1.5.2
19/06/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This…
*-1.4.9
1.5.0
31/03/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 – Unauthenticated PHP Object Injection via 'download_csv'
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it…
*-1.4.7
1.4.8
04/03/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 – Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it…
*-1.4.5
1.4.6
27/01/2026
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 – Unauthenticated PHP Object Injection to Arbitrary File Deletion
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it…
*-1.4.3
1.4.4
12/08/2025
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 – Unauthenticated Stored Cross-Site Scripting
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible…
*-1.3.8
1.3.9
22/04/2024
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping…
*-1.3.3
1.3.4
06/03/2024
Contact Form Entries <= 1.3.2 – Authenticated (Administrator+) Arbitrary File Upload
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level…
*-1.3.2
1.3.3
30/01/2024
Contact Form Entries <= 1.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode
The Contact Form Entries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vx-entries' shortcode attributes in versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for…
*-1.3.0
1.3.1
22/05/2023
Contact Form Entries <= 1.3.0 – Authenticated (Contributor+) SQL Injection via shortcode
The Contact Form Entries plugin for WordPress is vulnerable to generic SQL Injection via the plugin's shortcode attributes in versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient…
*-1.3.0
1.3.1
22/05/2023
Contact Form Entries <= 1.2.9 – CSV Injection
The Contact Form Entries plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.2.9 when outputting to a CSV file. This allows low-level attackers to embed untrusted input contact forms that will be…
*-1.2.9
1.3.0
21/10/2022
Contact Form Entries <= 1.2.3 – Reflected Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
*-1.2.3
1.2.4
14/11/2021
CRM Perks – Various Plugins (Various Versions) – Reflected Cross-Site Scripting
Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-1.2.1
1.2.2
26/08/2021
Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 – Reflected Cross-Site Scripting
The Contact Form Entries – Contact Form 7, WPforms and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘start_date’ and ‘end_date’ parameters in versions up to, and including, 1.2.0 due to insufficient input sanitization…
*-1.2.0
1.2.1
24/08/2021
Contact Form Entries <= 1.1.6 – Unauthenticated Stored Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing…
*-1.1.6
1.1.7
05/01/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.