# crmperks Database for Contact Form 7, WPforms, Elementor forms.

Every CVE that names crmperks Database for Contact Form 7, WPforms, Elementor forms among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'](https://agentprime.io/advisories/CVE-2026-9145.md)
  `CVE-2026-9145` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Path traversal
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value](https://agentprime.io/advisories/CVE-2026-9843.md)
  `CVE-2026-9843` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 8.1 High · Not analysed yet · Published 20 Jun 2026 · Tags: Path traversal
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode](https://agentprime.io/advisories/CVE-2026-3831.md)
  `CVE-2026-3831` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 4.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'](https://agentprime.io/advisories/CVE-2026-2599.md)
  `CVE-2026-2599` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export](https://agentprime.io/advisories/CVE-2026-0825.md)
  `CVE-2026-0825` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 5.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Broken access control
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2025-7384.md)
  `CVE-2025-7384` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Insecure deserialization
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-3715.md)
  `CVE-2024-3715` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 7.2 High · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS)
- [Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode](https://agentprime.io/advisories/CVE-2024-2030.md)
  `CVE-2024-2030` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 6.4 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload](https://agentprime.io/advisories/CVE-2024-1069.md)
  `CVE-2024-1069` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 7.2 High · Not analysed yet · Published 31 Jan 2024 · Tags: Unrestricted file upload

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=crmperks-database-for-contact-form-7-wpforms-elementor-forms>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/crmperks-database-for-contact-form-7-wpforms-elementor-forms/>. Everything for agents: <https://agentprime.io/llms.txt>.