sevenspark

11 results · Clear filters · Feed

• Medium 4.4
  CVE-2026-5116

  Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

  The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms fo…

  sevenspark DTX – Dynamic Text Extension for Contact Form 7 Web / CMS
  Aug 5, 2026
• Medium 6.5
  CVE-2025-13146

  Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

  The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a …

  sevenspark DTX – Dynamic Text Extension for Contact Form 7 Web / CMS
  Jul 22, 2026
• Medium 5.3
  CVE-2025-63068

  WordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 – Dynamic Text Exte…

  sevenspark Contact Form 7 – Dynamic Text Extension
  Dec 9, 2025
• Medium 6.5
  CVE-2025-49243

  WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a…

  sevenspark ShiftNav – Responsive Mobile Menu
  Jun 6, 2025
• Medium 6.5
  CVE-2025-49242

  WordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.

  sevenspark Bellows Accordion Menu
  Jun 6, 2025
• Medium 4.3
  CVE-2024-56218

  WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability

  Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site Request Forgery.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.1.

  sevenspark Contact Form 7 – Dynamic Text Extension
  Dec 31, 2024
• Medium 4.3
  CVE-2024-10084

  Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode

  The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via the CF7_get_post_var shortcode. This makes it possible for authenticated attackers, with Contributor-l…

  sevenspark Contact Form 7 – Dynamic Text Extension Web / CMS
  Nov 5, 2024
• Medium 6.4
  CVE-2024-4710

  Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

  The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenu_mobile_close_button, ubermenu_toggle, ubermenu-search shortcodes in all versions up to, and including, 3.8.2 due to insufficient input sanit…

  sevenspark UberMenu Web / CMS
  May 21, 2024
• Medium 4.3
  CVE-2023-6630

  Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference

  The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user…

  sevenspark Contact Form 7 – Dynamic Text Extension Web / CMS
  Jan 11, 2024
• Medium 6.4
  CVE-2023-5164

  Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible …

  sevenspark Bellows Accordion Menu Web / CMS
  Oct 30, 2023
• Medium 4.3
  CVE-2020-36746

  Menu Swapper <= 1.1.0.2 - Cross-Site Request Forgery Bypass

  The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to missing or incorrect nonce validation on the mswp_save_meta() function. This makes it possible for unauthenticated atta…

  sevenspark Menu Swapper Web / CMS
  Jul 1, 2023