Medium
CVE-2026-14872
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 20
Reset filters
High
CVE-2026-57708
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-14870
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-9145
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
High
CVE-2026-12081
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection
High
CVE-2026-9843
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Medium
CVE-2026-3831
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Critical
CVE-2026-2599
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'
Medium
CVE-2026-0825
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Critical
CVE-2025-7384
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
High
CVE-2024-3715
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-2030
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
High
CVE-2024-1069
Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2023-33311
Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode
High
CVE-2023-31212
Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode
High
CVE-2022-3604
Contact Form Entries <= 1.2.9 - CSV Injection
Medium
CVE-2021-25079
Contact Form Entries <= 1.2.3 - Reflected Cross-Site Scripting
Medium
cc1e9778-2860-4e3c-a2e4-28f10d585fed
CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting
Medium
83d46dce-b218-49ed-85ee-0e8d2a391eb9
Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting
High
CVE-2021-25080
Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.