{"resultsPerPage":21,"startIndex":0,"totalResults":21,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-02T16:08:19.824","vulnerabilities":[{"cve":{"id":"CVE-2026-97661","sourceIdentifier":"security@wordfence.com","published":"2026-10-01T09:17:11.043","lastModified":"2026-10-01T19:17:25.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"scottpaterson","product":"Business Essentials for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:18:29.974570Z","id":"CVE-2026-97661","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/cf7-redirect-thank-you-page/tags/1.2.1/includes/modules/payments/cpt.php#L313","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cf7-redirect-thank-you-page/tags/1.2.1/includes/modules/payments/functions.php#L15","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cf7-redirect-thank-you-page/tags/1.2.1/includes/modules/payments/redirect_methods.php#L205","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3713721/cf7-redirect-thank-you-page","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a60043-a060-472b-9b43-e82a4d2420b0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-101928","sourceIdentifier":"security@wordfence.com","published":"2026-10-03T06:16:40.080","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g. those containing '&lt;tip&gt;') back into live HTML, meaning an entity-encoded script payload submitted as a comment author name — which bypasses sanitize_text_field — is rendered as executable markup when an administrator views wp-admin/edit-comments.php."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magicplugins","product":"Magic Tooltips For Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.34","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-03T15:27:43.986803Z","id":"CVE-2026-101928","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/magic-tooltips-for-contact-form-7/trunk/lib/wp-hooks.php#L96","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/magic-tooltips-for-contact-form-7/trunk/magic-tooltips-for-contact-form-7.php#L18","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3723483%40magic-tooltips-for-contact-form-7&new=3723483%40magic-tooltips-for-contact-form-7","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e8de22-c373-4f0c-9723-f19752ade4e7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93889","sourceIdentifier":"security@wordfence.com","published":"2026-10-03T07:16:48.680","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wardee","product":"Mail logging & Catcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-03T15:25:15.254747Z","id":"CVE-2026-93889","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Loggers/LogHelper.php#L69","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Loggers/WpMail.php#L30","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/MailAdminTable.php#L149","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Views/LogModal.php#L83","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3717442%40wp-mail-catcher&new=3717442%40wp-mail-catcher","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1d9d03-0216-484c-85ca-73f157595713?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-40807","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.287","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cf7-views","versions":[{"version":"n/a","lessThanOrEqual":"3.2.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:29.861696Z","id":"CVE-2026-40807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cf7-views/vulnerability/wordpress-cf7-views-complete-entry-management-for-contact-form-7-plugin-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94664","sourceIdentifier":"audit@patchstack.com","published":"2026-10-09T10:16:41.420","lastModified":"2026-10-09T21:17:07.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"add-ons.org","product":"PDF for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"pdf-for-contact-form-7","versions":[{"version":"0","lessThanOrEqual":"7.1.0","versionType":"custom","status":"affected","changes":[{"at":"7.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T20:04:56.389842Z","id":"CVE-2026-94664","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pdf-for-contact-form-7/vulnerability/wordpress-pdf-for-contact-form-7-plugin-7-1-0-arbitrary-file-download-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94666","sourceIdentifier":"audit@patchstack.com","published":"2026-10-09T10:16:41.690","lastModified":"2026-10-11T13:17:29.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ZealousWeb","product":"Generate PDF using Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"generate-pdf-using-contact-form-7","versions":[{"version":"0","lessThanOrEqual":"4.2.1","versionType":"custom","status":"affected","changes":[{"at":"4.2.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T12:00:47.485303Z","id":"CVE-2026-94666","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/generate-pdf-using-contact-form-7/vulnerability/wordpress-generate-pdf-using-contact-form-7-plugin-4-2-1-arbitrary-file-download-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104797","sourceIdentifier":"security@wordfence.com","published":"2026-10-10T04:18:08.677","lastModified":"2026-10-13T13:30:21.620","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member \"Update Profile Field\" action, resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to `UM()->user()->update_profile()` in the `account` context — which explicitly bypasses Ultimate Member's banned-key validation — without performing any submitter identity verification, ownership check, capability check, current-password reauthentication, or restriction on sensitive keys such as `user_pass`. This makes it possible for unauthenticated attackers to change the password of any WordPress user account, including Administrator accounts, by submitting a public Contact Form 7 form with a target email and `user_pass` as the field key, enabling full site takeover. Exploitation requires an administrator to have pre-configured a Contact Form 7 integration that maps the target email, field key, and value from public form inputs to the Ultimate Member Update Profile Field action — the exact workflow the plugin's own UI advertises for this action type."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"nasirahmed","product":"Advanced Form Integration — Connect Forms to 300+ Apps","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:43:54.754849Z","id":"CVE-2026-104797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/includes/triggers/cf7/cf7.php#L38","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/platforms/ultimatememberac/ultimatememberac.php#L169","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/platforms/ultimatememberac/ultimatememberac.php#L83","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3725787%40advanced-form-integration%2Ftags%2F2.10.0&old=3707004%40advanced-form-integration%2Ftags%2F2.9.0","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586fd95e-88c7-4eb8-826c-ae46a11ac21f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-105989","sourceIdentifier":"contact@wpscan.com","published":"2026-10-10T06:16:40.547","lastModified":"2026-10-13T20:36:00.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Accept PayPal Payments using Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-10T12:03:40.922787Z","id":"CVE-2026-105989","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/df2b15dd-1748-4dcf-8b4f-8c053dc0dd73/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-105990","sourceIdentifier":"contact@wpscan.com","published":"2026-10-10T06:16:40.677","lastModified":"2026-10-13T20:36:00.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Accept PayPal Payments using Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-10T12:03:24.468687Z","id":"CVE-2026-105990","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-62043","sourceIdentifier":"audit@patchstack.com","published":"2026-10-10T20:16:40.137","lastModified":"2026-10-13T13:28:15.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"sevenspark","product":"Contact Form 7 – Dynamic Text Extension","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"contact-form-7-dynamic-text-extension","versions":[{"version":"n/a","lessThanOrEqual":"5.0.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T11:54:31.053315Z","id":"CVE-2026-62043","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/contact-form-7-dynamic-text-extension/vulnerability/wordpress-contact-form-7-dynamic-text-extension-plugin-5-0-7-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-84254","sourceIdentifier":"contact@wpscan.com","published":"2026-10-11T07:17:25.180","lastModified":"2026-10-13T20:36:00.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"click5 CRM add-on to Contact Form 7","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T11:26:03.989010Z","id":"CVE-2026-84254","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1dbb03eb-97ba-4a0f-aeea-6a38a47c95e5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84261","sourceIdentifier":"contact@wpscan.com","published":"2026-10-11T07:17:25.590","lastModified":"2026-10-13T20:36:00.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"click5 CRM add-on to Contact Form 7","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T11:25:12.724469Z","id":"CVE-2026-84261","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/91689a2c-a282-496b-b295-435647a0bf7d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-107652","sourceIdentifier":"security@wordfence.com","published":"2026-10-14T02:16:57.297","lastModified":"2026-10-15T17:17:13.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"arshidkv12","product":"Database Addon for Contact Form 7 – CFDB7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T10:53:29.624040Z","id":"CVE-2026-107652","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/contact-form-cfdb-7.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L325","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.4.0/inc/admin-subpage.php#L329","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3737068%40contact-form-cfdb7&new=3737068%40contact-form-cfdb7","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de3606a-254c-4e5f-9499-b1cc79dce7c8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103999","sourceIdentifier":"security@wordfence.com","published":"2026-10-16T06:17:03.927","lastModified":"2026-10-16T15:17:02.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themefic","product":"Ultra Addons for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.54","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T14:34:36.374767Z","id":"CVE-2026-103999","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L869","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L895","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L901","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/inc/functions.php#L1703","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104246","sourceIdentifier":"contact@wpscan.com","published":"2026-10-17T06:16:33.347","lastModified":"2026-10-19T21:02:51.987","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form 7 Signature Addon","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"4.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T11:02:03.946067Z","id":"CVE-2026-104246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-fe9452c85281/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111574","sourceIdentifier":"contact@wpscan.com","published":"2026-10-21T06:16:48.137","lastModified":"2026-10-21T18:37:38.700","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Redirection for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"2.2.7","lessThan":"3.2.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-21T10:18:42.013010Z","id":"CVE-2026-111574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f40440de-3947-48f9-8fa4-200f83e87d8e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115193","sourceIdentifier":"security@mautic.org","published":"2026-10-26T14:16:30.760","lastModified":"2026-10-26T16:17:16.670","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data."}],"affected":[{"source":"security@mautic.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://packagist.org","packageName":"mautic/core","repo":"https://github.com/mautic/mautic","versions":[{"version":"7.0.0","lessThan":"7.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@mautic.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T14:58:46.837321Z","id":"CVE-2026-115193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mautic.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-3295-vq3p-93rw","source":"security@mautic.org"}]}},{"cve":{"id":"CVE-2026-92098","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:49.540","lastModified":"2026-10-28T16:17:09.927","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"webheadllc","product":"Webheadcoder Multi-Step Forms for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:28.512515Z","id":"CVE-2026-92098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/coreyt808/webheadcoder-multi-step-forms-for-contact-form-7/commit/16f71561797b71548021dc9c4e30b0456e718cd3","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7.1/cf7msm.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L1444","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L180","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L225","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L395","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa810af-e620-49e5-9be0-f9fc4d09ed6d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-62057","sourceIdentifier":"audit@patchstack.com","published":"2026-10-30T19:18:31.907","lastModified":"2026-10-30T19:22:27.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fahim Reza","product":"Divi Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cf7-styler-for-divi","versions":[{"version":"0","lessThanOrEqual":"4.1.0","versionType":"custom","status":"affected","changes":[{"at":"4.1.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:47:49.814558Z","id":"CVE-2026-62057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cf7-styler-for-divi/vulnerability/wordpress-divi-contact-form-7-plugin-4-1-0-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-109386","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.517","lastModified":"2026-10-31T07:16:34.517","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmudev","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.8.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L509","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L533","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L576","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L610","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L652","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L667","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/providers/hubspot/hustle-hubspot-api.php#L310","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.4/inc/provider/class-hustle-provider-admin-ajax.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26c0279-0b51-40a8-8d11-6f2cbb21e59a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107759","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.033","lastModified":"2026-11-01T18:17:06.830","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpo365","product":"WPO365 | MICROSOFT 365 GRAPH MAILER","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:15.381772Z","id":"CVE-2026-107759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Core/Script_Helpers.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Mail/Mailer.php#L71","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Ajax_Service.php#L284","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Log_Service.php#L80","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/apps/dist/wizard-chunk-G9IB6WhS.js#L154","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752919%40wpo365-msgraphmailer&new=3752919%40wpo365-msgraphmailer","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51ba0c2-588d-4241-977a-9649cb77c78e?source=cve","source":"security@wordfence.com"}]}}]}