Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
medium
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to...
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 7.16
- Fixed in:
- 7.16.1
- Disclosed:
- Sep 4, 2026
CVE-2026-75018 on NVD →
Custom Contact Forms <= 5.1.0.3 - Missing Authorization
critical
The Custom Contact Forms plugin for WordPress is vulnerable to authentication bypass due to missing capability checks on admin_init() function called via an 'init' hook in versions before 5.1.0.4. This makes it possible for unauthenticated attackers to download and modify the database of the affected site.
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 5.1.0.4
- Fixed in:
- 5.1.0.4
- Disclosed:
- Sep 17, 2014
Custom Contact Forms Plugin <= 5.1.0.2 - Reflected Cross-Site Scripting
medium
The Custom Contact Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an arbitrarily supplied parameter in versions up to, and including, 5.1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...
- CVSS:
- 6.1
(Wordfence)
- Affected:
- up to 5.1.0.3
- Fixed in:
- 5.1.0.3
- Disclosed:
- May 11, 2012
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database