Rocklobster
Rocklobster Contact Form 7: vulnerabilidades y CVE
Rocklobster Contact Form 7 tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-3247 | Media (5.3) | 0.25% | — | 16 abr 2025 | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key.… |
| CVE-2024-4704 | Media (6.1) | 0.45% | — | 27 jun 2024 | The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing. |
| CVE-2024-2242 | Media (6.1) | 1.3% | — | 13 mar 2024 | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output… |
| CVE-2023-6630 | Media (4.3) | 0.35% | — | 11 ene 2024 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user… |
| CVE-2023-6449 | Alta (7.2) | 1.7% | — | 1 dic 2023 | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name'… |
| CVE-2021-24159 | Alta (8.8) | 0.59% | — | 5 abr 2021 | Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through… |
| CVE-2020-35489 | Crítica (10) | 89% | — | 17 dic 2020 | The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. |
| CVE-2018-20979 | Crítica (9.8) | 2.0% | — | 22 ago 2019 | The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type. |
| CVE-2014-2265 | Media (5) | 3.1% | — | 14 mar 2014 | Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter. |