Contact Form To Db Vulnerabilities

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.7.6

Fix:

No patched version reported

Disclosed:

Oct 5, 2026

CVE-2026-39745 on NVD →

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unau...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.7.5

Fixed in:

1.7.6

Disclosed:

Sep 8, 2026

CVE-2026-13359 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jun 8, 2024

CVE-2024-35678 on NVD →

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

9.9

(Wordfence)

Affected:

up to 1.7.2

Fixed in:

1.7.3

Disclosed:

Jun 5, 2024

CVE-2024-35678 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Dec 20, 2023

CVE-2023-29096 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For Wo...

Affected:

up to 1.7.2

Fixed in:

1.7.2

Disclosed:

Oct 31, 2023

CVE-2023-36508 on NVD →

The Contact Form to DB by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in versions up to, and including, 1.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

Jun 23, 2023

CVE-2023-36508 on NVD →

The Contact Form to DB by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the cntctfrmtdb_department parameter in versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVSS:

8.8

(Wordfence)

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Apr 17, 2023

CVE-2023-29096 on NVD →

Update the WordPress Contact Form to DB by BestWebSoft plugin to the latest available version (at least 1.7.1). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Contact Form to DB by BestWebSoft Plugin. This could allow a malicious actor to inject malicious scripts, such as red...

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Apr 17, 2023

The Contact Form to DB plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

(Wordfence)

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Apr 14, 2023

The Contact Form to DB plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Apr 14, 2023

[en] The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.

Affected:

up to 1.5.7

Fixed in:

1.5.7

Disclosed:

Aug 13, 2019

CVE-2017-18492 on NVD →

[en] Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2,...

Affected:

up to 1.5.7

Fixed in:

1.5.7

Disclosed:

May 22, 2017

CVE-2017-2171 on NVD →

The Contact Form to DB plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

(Wordfence)

Affected:

up to 1.5.6

Fixed in:

1.5.7

Disclosed:

Apr 12, 2017

CVE-2017-18492 on NVD →

Affected:

up to 1.5.7

Fixed in:

1.5.7