Crmperks

By the Year

In 2026 there have been 5 vulnerabilities in Crmperks with an average score of 6.9 out of ten. Last year, in 2025 Crmperks had 3 security vulnerabilities published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 2.86

Recent Crmperks Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-9843	Jun 20, 2026	WordPress Contact-Form-7-DB v1.5.1: File Deletion Unauth RCE The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2026-3831	Apr 01, 2026	WordPress Form Plugins 1.4.9 Auth Cap Check Missing (Data Leak) The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2026-2599	Mar 05, 2026	PHP Object Injection via download_csv in Contact Form 7 Database 1.4.7 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2026-2568	Mar 03, 2026	WP Zendesk Stored XSS Pre1.1.5 via Form Input The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-0825	Jan 28, 2026	Auth Bypass: WordPress Form DB CSV Export <=1.4.5 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2025-7384	Aug 13, 2025	PHP Object Injection in Contact Form 7 <=1.4.3 get_lead_detail - RCE The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2025-7697	Jul 19, 2025	WP Plugin PHP OI in Google Sheets Integration <=1.1.1 The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
CVE-2025-7696	Jul 19, 2025	Pipedrive-CF7 Integration v1.2.3 PHP Object Injection via verify_field_val allows RCE The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
CVE-2024-12443	Dec 16, 2024	Stored XSS Vulnerability in CRM Perks WordPress HelpDesk Integration Plugin The CRM Perks WordPress HelpDesk Integration Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-37463	Nov 01, 2024	Missing Auth in CRM Perks Forms (1.1.5) via unrestricted ACLs Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.	Crm Perks Forms
CVE-2024-7484	Aug 06, 2024	CRM Perks Forms 1.1.3 Or Earlier: Arb File Upload via handle_uploaded_files The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.	Crm Perks Forms
CVE-2024-3715	May 02, 2024	WPForms/CF7 Stored XSS in Forms DB (1.3.8) The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2024-30446	Mar 29, 2024	CRM Perks Forms Stored XSS CVE-2024-30446 Affected before v1.1.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.	Crm Perks Forms
CVE-2024-30499	Mar 29, 2024	SQLi in CRM Perks Forms pre-1.1.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.	Crm Perks Forms
CVE-2024-30498	Mar 29, 2024	SQL Injection in CRM Perks Forms 1.1.4 due to Improper Neutralization Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.	Crm Perks Forms
CVE-2024-2030	Mar 13, 2024	Stored XSS in Contact Form 7 WPForms Elementor Forms (1.3.3) The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2023-51536	Feb 01, 2024	CrossSite Scripting in CRM Perks Forms WordPress Form Builder <=1.1.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms WordPress Form Builder: from n/a through 1.1.2.	Crm Perks Forms
CVE-2024-1069	Jan 31, 2024	Arbitrary File Upload in WP Contact Form Entries 1.3.2 via view_page The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2022-3604	Jan 16, 2024	CSV Injection in Contact Form Entries WP Plugin before 1.3.0 The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2023-31095	Dec 29, 2023	CRM Perks Integration for HubSpot <=1.2.8 Open Redirect URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2023-37982	Dec 19, 2023	Open Redirect in WP Plugin 'CRM Perks Integration for Salesforce', v<=1.3.3 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.	Integration Salesforce Contact Form 7 Wpforms Elementor Ninja Forms
CVE-2023-38481	Dec 19, 2023	Open Redirect in CRM Perks Integration for WooCommerce & Zoho CRM (before 1.3.7) URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7.	Integration Woocommerce Zoho Crm Books Invoice Inventory Bigin
CVE-2023-38478	Dec 19, 2023	Open Redirect in CRM Perks WooCommerce/QuickBooks Integration (1.2.3) URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.	Integration Woocommerce Quickbooks
CVE-2023-47779	Dec 07, 2023	CRM Perks Open Redirect via Integration for Constant Contact v1.1.4 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.	Integration Constant Contact Contact Form 7 Wpforms Elementor Ninja
CVE-2023-31212	Oct 31, 2023	WordPress Plugin CRM Perks DB <=1.3.0 SQL Injection via Contact Form Entries Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.	Database Contact Form 7 Wpforms Elementor Forms
CVE-2023-2527	Jun 19, 2023	WordPress Plugin Integration for CF7 & Zoho CRM 1.2.3 SQL Injection The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin	Integration Contact Form 7 Zoho Crm Bigin
CVE-2023-2836	May 31, 2023	Stored XSS in Perks Forms WP Plugin v1.1.1 via form settings The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	Crm Perks Forms
CVE-2023-33311	May 28, 2023	Stored XSS in CRM Perks Contact Form Entries <=1.3.0 (WordPress) Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.	Contact Form Entries Contact Form 7 Wpforms More
CVE-2023-25976	May 26, 2023	CSRF in CRM Perks Integration (CF7 & Bigin) 1.2.2 Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.	Integration Contact Form 7 Zoho Crm Bigin
CVE-2022-38467	Jan 14, 2023	CRM Perks Forms <=1.1.0 WordPress Form Builder Reflected XSS Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms WordPress Form Builder <= 1.1.0 ver.	Crm Perks Forms
CVE-2021-25080	Jan 24, 2022	The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry	Contact Form Entries
CVE-2021-25079	Jan 24, 2022	The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page	Contact Form Entries