Vulnerabilities

TI-2025-06121 CVE-2025-6740 · GHSA-72r8-m4j3-hjr5

Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter

LOW 27

The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00308 Published 2025-07-04 No fix listed CWE-79

TI-2023-14801 CVE-2023-31075 · GHSA-rwmv-5cmc-6rpx

WordPress Easy Hide Login Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00312 Published 2023-11-18 No fix listed CWE-352

TI-2023-15787 CVE-2023-32505 · GHSA-5crf-ph27-96cw

WordPress Easy Hide Login Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Arshid Easy Hide Login plugin <= 1.0.7 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00396 Published 2023-08-23 No fix listed CWE-79

TI-2022-03941 CVE-2022-4303 · GHSA-mpvm-97hc-j3fx

WP Limit Login Attempts <= 2.6.4 - IP Spoofing

HIGH 72

The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00711 Published 2023-01-23 No fix listed CWE-290

TI-2022-03344 CVE-2022-3634 · GHSA-c77w-6vg2-c6cj

Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

HIGH 82

The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03981 Published 2022-11-21 Fixed in 1.2.6.5

TI-2021-14975 CVE-2021-36886 · GHSA-rw8v-f293-8h38

WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability

LOW 39

Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00561 Published 2021-12-22 No fix listed CWE-352

TI-2021-14974 CVE-2021-36885 · GHSA-f57v-3pv4-pqw9

Cross-site scripting in CipherCoin Contact Form 7 Database Addon – CFDB7

LOW 29

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00782 Published 2021-12-22 No fix listed CWE-79

TI-2021-06436 CVE-2021-24144 · GHSA-gcp2-r7p4-r5p4

Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection

LOW 37

Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01244 Published 2021-03-18 Fixed in 1.2.5.6 CWE-74

TI-2015-05728 CVE-2015-6829 · GHSA-v4fj-7hcj-whx2

Multiple SQL injection vulnerabilities in the getip function in…

LOW 37

Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via th…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0235 Published 2015-09-16 No fix listed CWE-89

Vulnerabilities

Filters