zealopensource
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Accept Stripe Payments Using Contact Form 7 | 2 | – | Dec 12, 2025 |
| Generate PDF using Contact Form 7 | 2 | – | Jul 9, 2024 |
| Smart Appointment & Booking | 2 | – | May 12, 2026 |
| Abandoned Contact Form 7 | 1 | – | Jun 16, 2026 |
| User Registration Using Contact Form 7 | 1 | – | Jan 17, 2026 |
| Accept Authorize.NET Payments Using Contact Form 7 | 1 | – | Dec 18, 2024 |
| Accept SagePay Payments Using Contact Form 7 | 1 | – | Apr 8, 2025 |
Exploited and recent CVEs
- CVE-2026-9187 Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter 0.2%
- CVE-2026-5693 Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation 0.2%
- CVE-2026-0742 Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action 0.3%
- CVE-2025-12825 User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure 0.6%
- CVE-2025-12834 Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message 0.2%
- CVE-2025-2883 Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure 0.4%
- CVE-2024-12250 Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure 0.4%
- CVE-2024-12255 Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure 0.5%
- CVE-2024-6316 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload 0.5%
- CVE-2024-6317 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion 0.6%