Send Pdf For Contact Form 7 Vulnerabilities

[en] The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entrie...

Affected:

up to 1.0.2.4

Fixed in:

1.0.2.4

Disclosed:

May 2, 2024

CVE-2024-3585 on NVD →

The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries wit...

CVSS:

5.3

Affected:

up to 1.0.2.3

Fixed in:

1.0.2.4

Disclosed:

Apr 23, 2024

CVE-2024-3585 on NVD →

[en] The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...

Affected:

up to 0.9.9.2

Fixed in:

0.9.9.2

Disclosed:

Feb 6, 2023

CVE-2023-0143 on NVD →

The Send PDF for Contact Form 7 for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 0.9.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor lev...

CVSS:

6.4

Affected:

up to 0.9.9.1

Fixed in:

0.9.9.2

Disclosed:

Jan 11, 2023

CVE-2023-0143 on NVD →

The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on multiple parameters. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 0.9.1

Fixed in:

0.9.2

Disclosed:

Jun 19, 2022

The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on multiple parameters. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 0.9.2

Fixed in:

0.9.2

Disclosed:

Jun 19, 2022