Threat database

2 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.1	EPSS 0.2%	CVE-2026-39731Database for CF7 · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39731 Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. EPSS 0.2%Vulnerability code4life #cwe-79	CVE Database V5	2026-10-06
High	7.2	EPSS 0.4%	CVE-2026-13425Database for CF7 · Cross-site Scripting High7.2EPSS 0.4%2026-07-29CVE Database V5CVE-2026-13425 The Database for CF7 WordPress plugin is vulnerable to stored cross-site scripting (XSS) via array form field values in all versions up to and including 1.2.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page. The issue is exploitable through the Contact Form 7 REST API endpoint, which accepts array-structured input and stores it without proper filtering. EPSS 0.4%Vulnerability code4life #cwe-79	CVE Database V5	2026-07-29

Showing 1–2 of 2 results