Contact Form DB

Contact Form DB has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2018; all 5 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.6 out of 10. Severity breakdown: 0 critical and 1 high. 2015 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Injection.

Every one of the 5 issues recorded for Contact Form DB has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Contact Form DB vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.6CVE-2018-9035

Contact Form 7 to Database Extension 2.10.32 - CSV Injection

Read the full analysis

Vulnerability Records

5 records


2018-04-09 00:00	Contact Form 7 to Database Extension 2.10.32 - CSV Injection Contact Form DB 2.10.32	`CVE-2018-9035`	8.6 High	Anonymous	Yes
2015-03-04 00:00	Contact Form DB <= 2.8.29 - Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php Contact Form DB <= 2.8.29	`CVE-2015-1874`	4.3 Medium	Tom Adams	Yes
2015-02-22 00:00	Contact Form DB <= 2.8.26 - Authenticated Cross-Site Scripting Contact Form DB <= 2.8.26	`CVE-2015-2040`	6.5 Medium	Anonymous	Yes
2014-11-26 00:00	Contact Form DB <= 2.8.17 - Reflected Cross-Site Scripting Contact Form DB < 2.8.18	`N/A`	6.1 Medium	Tim Coen	Yes
2014-10-10 00:00	Contact Form DB <= 2.8.19 - Cross-Site Scripting Contact Form DB <= 2.8.19	`CVE-2014-7139`	6.1 Medium	High-Tech Bridge Security Research Lab	Yes

Showing 1–5 of 5 reports