Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Contact Form Submissions Project Component: Contact Form Submissions Clear all filters
TI-2022-00183 CVE-2022-0248 · GHSA-v4p8-327w-c7fp

Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS

Priority LOW 31

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01717 Published 2022-03-14 Fixed in 1.7.3 CWE-79
TI-2021-06417 CVE-2021-24125 · GHSA-rm93-cq74-9hhc

Contact Form Submissions < 1.7.1 - Authenticated SQL Injection

Priority LOW 35

Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01456 Published 2021-03-18 Fixed in 1.7.1 CWE-89