Login Request a demo
CF
Product
Contact Form Email
by codepeople · last CVE Oct 22, 2026
12
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 0High 2Medium 10Low 0
Severity
All severities12Critical0High2Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Contact Form Email to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-20964
8.8
1%
Aug 13
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF
Affected: before 1.2.66
CVE-2026-112379
New
7.1
0%
Oct 22
WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
Affected: through 1.3.68
CVE-2026-32483
6.5
0%
Mar 25
WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability
Affected: through <= 1.3.63
CVE-2023-48318
6.5
0%
Jun 4
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from…
Affected: before 1.3.42
CVE-2018-20963
6.1
1%
Aug 13
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS
Affected: before 1.2.66
CVE-2019-9646
6.1
1%
Mar 10
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
Affected: before 1.2.66
CVE-2023-2718
5.4
1%
Jun 12
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability
Affected: before 1.3.38
CVE-2024-31302
5.3
0%
Apr 10
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44
Affected: before 1.3.44
CVE-2025-24727
4.8
0%
Jan 24
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This…
Affected: before 1.3.53
CVE-2023-5955
4.8
0%
Dec 11
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored…
Affected: before 1.3.44
CVE-2021-42361
4.8
1%
Nov 17
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the…
Affected: through 1.3.24
CVE-2023-28494
4.3
0%
Jun 4
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31
Affected: before 1.3.32
Showing 12