The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directo [truncated]
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field. This vulnerability allows unauthenticated attackers to inject web scripts that execute when a user accesses an injected page. The vulnerability exists in versions up to and including 2.10.1. Exploitation requires tricking a user into clic [truncated]
HT Contact Form – Drag & Drop Form Builder for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'file_upload' parameter in versions up to and including 2.8.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Exploitation requires the 'Store Submissions' setting to be enabled, which persists unsanitized field values to [truncated]
