| CVE-2023-47830 | WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability | GusRuss89 | Live Preview for Contact Form 7 | Medium | 5.4 | 2024-12-09 11:30:40 | Deep Dive |
| CVE-2023-47838 | WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability | Jules Colle | Conditional Fields for Contact Form 7 | 中危 | - | 2024-12-09 11:30:37 | Deep Dive |
| CVE-2023-47871 | WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability | itpathsolutions | Contact Form to Any API | Medium | 4.3 | 2024-12-09 11:30:33 | Deep Dive |
| CVE-2024-12165 | Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting | tsjippy | Mollie for Contact Form 7 | Medium | 6.1 | 2024-12-07 01:45:52 | Deep Dive |
| CVE-2024-12026 | Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation | kofimokome | Message Filter for Contact Form 7 | Medium | 4.3 | 2024-12-07 01:45:50 | Deep Dive |
| CVE-2024-12027 | Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions | kofimokome | Message Filter for Contact Form 7 | Medium | 4.3 | 2024-12-06 08:24:53 | Deep Dive |
| CVE-2024-10056 | Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode | eyale-vc | Contact Form Builder by vcita | Medium | 6.4 | 2024-12-05 09:23:07 | Deep Dive |
| CVE-2024-5020 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library | extendthemes | Colibri Page Builder | Medium | 6.4 | 2024-12-04 08:22:47 | Deep Dive |
| CVE-2024-11897 | Contact Form, Survey & Form Builder – MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | mightyforms | Contact Form, Survey & Form Builder – MightyForms | Medium | 6.4 | 2024-12-04 02:40:27 | Deep Dive |
| CVE-2024-10587 | Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection | funnelforms | Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free | High | 8.8 | 2024-12-04 02:40:25 | Deep Dive |
| CVE-2024-11188 | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter | strategy11team | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | Medium | 6.1 | 2024-11-23 05:40:11 | Deep Dive |
| CVE-2024-10898 | Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion | krishaweb | Email addon for CF7 | High | 8.8 | 2024-11-21 02:06:46 | Deep Dive |
| CVE-2024-11038 | WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form | wpbean | WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click | High | 7.3 | 2024-11-19 11:02:29 | Deep Dive |
| CVE-2024-10884 | SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting | simpleform | SimpleForm Contact Form Submissions | Medium | 6.1 | 2024-11-16 03:20:41 | Deep Dive |
| CVE-2024-10883 | SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting | simpleform | SimpleForm – Contact form made simple | Medium | 6.1 | 2024-11-16 03:20:40 | Deep Dive |
| CVE-2024-10861 | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update | ays-pro | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | Medium | 5.3 | 2024-11-16 02:02:32 | Deep Dive |
| CVE-2024-10260 | Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload | tripetto | WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | High | 7.2 | 2024-11-15 05:30:56 | Deep Dive |
| CVE-2024-10593 | WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion | smub | WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More | Medium | 4.3 | 2024-11-13 02:33:17 | Deep Dive |
| CVE-2024-10685 | Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting | scottpaterson | Business Essentials for Contact Form 7 | Medium | 6.1 | 2024-11-12 03:24:59 | Deep Dive |
| CVE-2024-10265 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter | 10web | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | Medium | 6.1 | 2024-11-10 12:30:34 | Deep Dive |