Kofimokome
Monthly
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the Message Filter for Contact Form 7 WordPress plugin (versions through 1.6.3.2) enables authenticated high-privileged users to manipulate backend database queries, potentially exposing or modifying the entire WordPress database. Discovered and reported by Patchstack (audit@patchstack.com), the flaw carries a CVSS score of 7.2, with the PR:H metric confirming that exploitation is gated behind administrator-level credentials. No public exploit code and no active exploitation have been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.6.1.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the Message Filter for Contact Form 7 WordPress plugin (versions through 1.6.3.2) enables authenticated high-privileged users to manipulate backend database queries, potentially exposing or modifying the entire WordPress database. Discovered and reported by Patchstack (audit@patchstack.com), the flaw carries a CVSS score of 7.2, with the PR:H metric confirming that exploitation is gated behind administrator-level credentials. No public exploit code and no active exploitation have been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.6.1.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.