Vulnerabilities

TI-2026-70382 CVE-2026-62043 · GHSA-rv7w-735h-fpxv

Sensitive data exposure in Contact Form 7 Dynamic Text Extension

LOW 39

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00303 Published 2026-10-10 No fix listed CWE-201

TI-2026-04467 CVE-2026-5116 · GHSA-h3v3-jhc3-m8w7

Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

LOW 20

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00311 Published 2026-08-05 No fix listed CWE-79

TI-2025-12018 CVE-2025-13146 · GHSA-6pxf-96xx-73mh

Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

LOW 35

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00471 Published 2026-07-22 No fix listed CWE-94

TI-2025-39216 CVE-2025-63068 · GHSA-3g27-fg6w-fm64

WordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability

LOW 24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue aff…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00281 Published 2025-12-09 No fix listed CWE-80

TI-2025-31291 CVE-2025-49243 · GHSA-pmr2-6qw8-g5h4

WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects Shif…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00269 Published 2025-06-06 No fix listed CWE-79

TI-2025-31290 CVE-2025-49242 · GHSA-pwjp-r4cj-h394

WordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu:…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00269 Published 2025-06-06 No fix listed CWE-79

TI-2024-37188 CVE-2024-56218 · GHSA-qv2c-9cgg-8g7p

WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site Request Forgery.This issue affects Contact Form 7 – Dynamic Te…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00154 Published 2024-12-31 No fix listed CWE-352

TI-2024-09347 CVE-2024-10084 · GHSA-whgh-j242-j2mm

Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode

LOW 20

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via the CF7_get_post_var shortcode.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00353 Published 2024-11-05 No fix listed CWE-200

TI-2024-03348 CVE-2024-3593 · GHSA-jv3q-9p36-3jg6

UberMenu <= 3.8.3 - Cross-Site Request Forgery to Settings Reset

LOW 37

The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00177 Published 2024-06-22 No fix listed CWE-352

TI-2024-04383 CVE-2024-4710 · GHSA-3h24-j2vg-3wvf

Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

LOW 28

The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenu_mobile_close_button, ubermenu_toggle, ubermenu-search shortcodes in all versions up to, and including…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00267 Published 2024-05-21 No fix listed CWE-79

TI-2023-06076 CVE-2023-6630 · GHSA-c2vp-9842-2xq2

Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference

LOW 20

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortco…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00346 Published 2024-01-11 No fix listed CWE-359

TI-2023-04752 CVE-2023-5164 · GHSA-mr7q-pq37-qv94

Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 29

The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user suppl…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00519 Published 2023-10-30 No fix listed CWE-79

TI-2020-18915 CVE-2020-36746 · GHSA-75rv-9hj4-6wwc

Menu Swapper <= 1.1.0.2 - Cross-Site Request Forgery Bypass

LOW 20

The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00464 Published 2023-07-01 No fix listed CWE-352

TI-2022-04228 CVE-2022-4627 · GHSA-87ww-8m9q-337f

ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode

MEDIUM 58

The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Store…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 1.7.2 CWE-79

Vulnerabilities

Filters