New Contact Form Widget Vulnerabilities

The Contact Form Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they c...

CVSS:

4.3

Affected:

up to 1.5.1

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62134 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through 1.5.1.

Affected:

up to 1.5.1

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62134 on NVD →

The Contact Form Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.6. This is due to missing or incorrect nonce validation in the all-query-page.php file. This makes it possible for unauthenticated attackers to trigger a download of user lists via a forged req...

CVSS:

4.3

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

May 7, 2025

CVE-2025-47491 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery. This issue affects Contact Form Widget: from n/a through 1.4.6.

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

May 7, 2025

CVE-2025-47491 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through 1.4.2.

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Oct 17, 2024

CVE-2024-48037 on NVD →

The Contact Form Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'delete-contact-query' case in the all-query-page.php file. This makes it possible for unauthenticated attackers to delate contact...

CVSS:

4.3

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Oct 9, 2024

CVE-2024-48037 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a through 1.3.9.

Affected:

up to 1.4.0

Fixed in:

1.4.0

Disclosed:

Jun 3, 2024

CVE-2024-34754 on NVD →

The Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.9. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 1.3.9

Fixed in:

1.4.0

Disclosed:

May 14, 2024

CVE-2024-34754 on NVD →

The Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.3.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

CVSS:

8

Affected:

up to 1.3.8

Fixed in:

1.3.9

Disclosed:

Oct 10, 2019

CVE-2019-17072 on NVD →

[en] The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Oct 10, 2019

CVE-2019-17072 on NVD →