CP Contact Form with PayPal
cp-contact-form-with-paypal · plugin
Known security vulnerabilities for CP Contact Form with PayPal. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
4 exploitable without logging in · latest Mar 13, 2026
Listed on wordpress.org · latest 1.3.68 · last updated Sep 21, 2026 · 800+ installs
wordpress.org status checked on Oct 5, 2026
Vulnerabilities
- High 8.8
CVE-2015-9233unauthenticated · needs a click
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to
- High 8.8
CVE-2023-27460login required≤ 1.3.34
WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerability
- High 8.5
CVE-2026-32433login required≤ 1.3.61
WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability
- High 7.5
CVE-2025-13384unauthenticated≤ 1.3.56
CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
- High 7.2
CVE-2015-9234high privilege
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform
- Medium 6.5
CVE-2024-13758unauthenticated · needs a click≤ 1.3.52
CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery
- Medium 6.1
CVE-2019-14784unauthenticated · needs a click
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
- Medium 5.4
CVE-2019-14785login required
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_con
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).