Database for Contact Form 7, WPforms, Elementor forms
contact-form-entries · plugin
Known security vulnerabilities for Database for Contact Form 7, WPforms, Elementor forms. Find out in seconds which version runs on your site with WP Lens.
12 known vulnerabilities
3 critical · 1 with public exploit code · latest Jul 13, 2026
Vulnerabilities
- Critical 9.8
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'
- Critical 9.8
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
- Critical 9.8
WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL Injection
- High 8.1
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
- High 7.2
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting
- High 7.2
Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
- High 7.1
WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
- Medium 6.4
Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- Medium 5.4
WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.3
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
- Medium 4.3
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Short