Skip to content
OpenAdvisories

Vendor

zealopensource

10 known vulnerabilities.

zealopensource at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 1 vulnerability February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202610
May 202610
Apr 202600
Mar 202600
Feb 202610
Jan 202610
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202500
Feb 202500
Jan 202500
Dec 202420

Products

Accept Stripe Payments Using Contact Form 7 2 Smart Appointment & Booking 2 Generate PDF using Contact Form 7 2 User Registration Using Contact Form 7 1 Accept Authorize.NET Payments Using Contact Form 7 1 Abandoned Contact Form 7 1 Accept SagePay Payments Using Contact Form 7 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 5.3
    CVE-2026-9187

    Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter

    The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, w…

    zealopensource Abandoned Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2026-5693

    Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation

    The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The …

    zealopensource Smart Appointment & Booking Web / CMS
  • Medium 6.4
    CVE-2026-0742

    Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action

    The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form_data AJAX action in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied a…

    zealopensource Smart Appointment & Booking Web / CMS
  • Medium 5.3
    CVE-2025-12825

    User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure

    The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function in all versions up to, and including, 2.5. This makes it possible for unauthenti…

    zealopensource User Registration Using Contact Form 7 Web / CMS
  • Medium 6.1
    CVE-2025-12834

    Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message

    The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This mak…

    zealopensource Accept Stripe Payments Using Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2025-2883

    Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure

    The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated atta…

    zealopensource Accept SagePay Payments Using Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2024-12250

    Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure

    The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configura…

    zealopensource Accept Authorize.NET Payments Using Contact Form 7 Web / CMS
  • Medium 5.3
    CVE-2024-12255

    Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure

    The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers …

    zealopensource Accept Stripe Payments Using Contact Form 7 Web / CMS
  • High 8.8
    CVE-2024-6316

    Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload

    The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pd…

    zealopensource Generate PDF using Contact Form 7 Web / CMS
  • High 8.8
    CVE-2024-6317

    Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion

    The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or i…

    zealopensource Generate PDF using Contact Form 7 Web / CMS