Vulnerabilities

TI-2026-13238 CVE-2026-15735 · GHSA-5j37-75mq-f752

Cross-site scripting in IT Path Solutions Contact Form to Any API

LOW 28

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-29 No fix listed CWE-79

TI-2026-28426 CVE-2026-39449 · GHSA-xgpc-pf53-8726

WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-06-15 No fix listed CWE-79

TI-2026-01565 CVE-2026-1899 · GHSA-fhwh-m653-p2c2

Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute

LOW 28

The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0025 Published 2026-03-21 No fix listed CWE-79

TI-2025-22945 CVE-2025-31808 · GHSA-hqrg-2p9v-rv84

WordPress SCSS WP Editor plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in IT Path Solutions SCSS WP Editor scss-wp-editor allows Cross Site Request Forgery.This issue affects SCSS WP Editor: from n/a through <= 1.2.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00213 Published 2025-04-01 No fix listed CWE-352

TI-2023-25975 CVE-2023-47871 · GHSA-gf8c-4235-7g24

WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability

LOW 21

Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00485 Published 2024-12-09 No fix listed CWE-862

TI-2024-07061 CVE-2024-7617 · GHSA-mc8h-gfm5-j86q

Contact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form

LOW 35

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output e…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00615 Published 2024-09-25 No fix listed CWE-79

TI-2024-19988 CVE-2024-30242 · GHSA-wjw7-pmq5-rw6m

WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability

LOW 38

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00549 Published 2024-03-28 No fix listed CWE-89

TI-2023-16007 CVE-2023-32741 · GHSA-qgj5-fp5w-7cxr

WordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL Injection

HIGH 68

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: fro…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00701 Published 2023-11-03 No fix listed CWE-89

Vulnerabilities

Filters