CVE-2024-4144

The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.

• CWE-94

• https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543
• https://plugins.trac.wordpress.org/changeset/3085036/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve
• https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543
• https://plugins.trac.wordpress.org/changeset/3085036/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41434PingCAP TiDB v8.1.0 was discovered to contain a buffer overf…4.3
• CVE-2024-41435YugabyteDB v2.21.1.0 was discovered to contain a buffer over…7.5
• CVE-2024-41436ClickHouse v24.3.3.102 was discovered to contain a buffer ov…7.5
• CVE-2024-41437A heap buffer overflow in the function cp_unfilter() (/vendo…5.5
• CVE-2024-41438A heap buffer overflow in the function cp_stored() (/vendor/…6.2
• CVE-2024-41439A heap buffer overflow in the function cp_block() (/vendor/c…5.5
• CVE-2024-41440A heap buffer overflow in the function png_quantize() of hic…6.2
• CVE-2024-41443A stack overflow in the function cp_dynamic() (/vendor/cute_…5.5
• CVE-2024-41444SeaCMS v12.9 has a SQL injection vulnerability in the key pa…9.8
• CVE-2024-41445Library MDF (mdflib) v2.1 is vulnerable to a heap-based buff…6.5
• CVE-2024-41446A stored cross-site scripting (XSS) vulnerability in Alkacon…5.4
• CVE-2024-41447A stored cross-site scripting (XSS) vulnerability in Alkacon…5.4