Contact Forms Builder Vulnerabilities

The Contact Form Builder, Contact Widget plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 1.6.1

Fix:

No patched version reported

Disclosed:

May 10, 2026

CVE-2022-50959 on NVD →

[en] Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Jun 10, 2024

CVE-2024-35747 on NVD →

The Contact Form Builder, Contact Widget plugin for WordPress is vulnerable to protection bypass in all versions up to, and including, 2.1.7. This is due to the plugin not properly restricting authentication attempts. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Jun 6, 2024

CVE-2024-35747 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Oct 26, 2023

CVE-2023-46075 on NVD →

The Contact Form Builder, Contact Widget plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Oct 16, 2023

CVE-2023-46075 on NVD →