2
CVEs
0
Critical
2
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (12)
Wordpress Plugin
12
PHP
8
Wp Insightly For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms
2
Integration For Mailchimp And Contact Form 7 Wpforms Elementor Ninja Forms
2
Integration For Keap Infusionsoft And Contact Form 7 Wpforms Elementor Formidable Ninja Forms
1
Integration For Activecampaign And Contact Form 7 Wpforms Elementor Ninja Forms
1
Crm Perks Forms
1
Integration For Salesforce And Contact Form 7 Wpforms Elementor Formidable Ninja Forms
1
Integration For Contact Form 7 And Constant Contact
1
Contact Form Entries
1
Integration For Contact Form 7 Hubspot
1
Wp Zendesk For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-57421 | Reflected cross-site scripting in the CRM Perks Forms WordPress plugin (all versions up to and including 1.1.7) lets an unauthenticated attacker inject script that executes in a victim's browser when they open a crafted link. Patchstack catalogued the issue at CVSS 3.1 7.1, and the scope-changed vector reflects that injected script runs in the WordPress site's origin rather than a sandbox. No public exploit or active exploitation has been identified at time of analysis, so risk is driven by the low attack complexity and required user interaction rather than mass exploitation. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-57708 | Reflected cross-site scripting in the CRM Perks "Contact Form Entries" WordPress plugin (versions up to and including 1.5.2) lets remote attackers inject script that executes in a victim's browser after the victim clicks a crafted link. Because the CVSS scope is changed (S:C), successful injection can reach data and actions beyond the vulnerable component, typically the WordPress admin/session context. No public exploit has been identified and it is not on CISA KEV; the flaw was reported by Patchstack. | HIGH | 7.1 | 0.3% | 36 |
No patch
|