Read the docs

Contact Form Submissions Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Contact Form Submissions Project records in CISA KEV

No Contact Form Submissions Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Contact Form Submissions 2 records LOW

Records

2 records

TI-2021-06417 CVE-2021-24125 · GHSA-rm93-cq74-9hhc

Contact Form Submissions < 1.7.1 - Authenticated SQL Injection

Priority LOW 35

Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01456 Published 2021-03-18 Fixed in 1.7.1 CWE-89
TI-2022-00183 CVE-2022-0248 · GHSA-v4p8-327w-c7fp

Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS

Priority LOW 31

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01717 Published 2022-03-14 Fixed in 1.7.3 CWE-79
Open these records in search →