cfdbplugin contact form db vulnerabilities

Latest cfdbplugin contact form db CVEs

Newest publication first

1. CVE-2015-1874 Contact Form DB <= 2.8.29 - Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php

   Published 2015-03-09

   Medium·CVSS 6.8 EPSS 1.5%

   Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a r...

2. CVE-2015-2040 Contact Form DB <= 2.8.26 - Authenticated Cross-Site Scripting

   Published 2015-02-20

   Medium·CVSS 4.3 EPSS 1.6%

   Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-ad...

3. CVE-2014-7139 Contact Form DB <= 2.8.19 - Cross-Site Scripting

   Published 2014-10-10

   Medium·CVSS 4.3 EPSS 2.0%

   Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPlugin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.