ciphercoin contact form 7 database addon vulnerabilities

Latest ciphercoin contact form 7 database addon CVEs

Newest publication first

1. CVE-2025-6740 Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter

   Published 2025-07-04

   Medium·CVSS 6.1 EPSS 0.31%

   The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

2. CVE-2022-3634 Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

   Published 2022-11-21

   Critical·CVSS 9.8 EPSS 4.0%

   The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection

3. CVE-2021-36886 WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability

   Published 2021-12-22

   High·CVSS 8.8 EPSS 0.56%

   Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).

4. CVE-2021-36885 WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

   Published 2021-12-22

   Medium·CVSS 6.1 EPSS 0.78%

   Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).

5. CVE-2021-24144 Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection

   Published 2021-03-18

   High·CVSS 7.8 EPSS 1.2%

   Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.