Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values
high
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wi...
- CVSS:
- 7.2
- Affected:
- up to 1.2.6
- Fix:
- No patched version reported
- Disclosed:
- Jul 28, 2026
CVE-2026-13425 on NVD →
Database for CF7 <= 1.2.4 - Missing Authorization via wpcf7db_delete AJAX action
medium
The Database for CF7 plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpcf7db_delete AJAX function in versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete CF7 Database entries.
- CVSS:
- 6.5
- Affected:
- up to 1.2.4
- Fixed in:
- 1.2.5
- Disclosed:
- Nov 29, 2023
CVE-2023-49167 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database