Contact Form Ready Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Contact Form allows DOM-Based XSS. This issue affects Contact Form: from n/a through 2.0.12.

Affected:

up to 2.0.12

Fix:

No patched version reported

Disclosed:

Jun 6, 2025

CVE-2025-30935 on NVD →

The Contact Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 2.0.12

Fix:

No patched version reported

Disclosed:

Jun 5, 2025

CVE-2025-30935 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.

Affected:

up to 2.0.12

Fixed in:

2.0.12

Disclosed:

Oct 9, 2023

CVE-2023-44231 on NVD →

The Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.10. This is due to missing or incorrect nonce validation on the wpcf_styling_page() function. This makes it possible for unauthenticated attackers to modify the contact form's styling via a forged req...

CVSS:

4.3

Affected:

up to 2.0.11

Fixed in:

2.0.12

Disclosed:

Sep 29, 2023

CVE-2023-44231 on NVD →