Login Request a demo
CM
Product
Contact Manager
by kleor · last CVE Oct 28, 2026
5
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 1High 3Medium 1Low 0
Severity
All severities5Critical1High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Contact Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-109218
New
9.8
1%
Oct 28
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
Affected: through 9.1.2
CVE-2025-68853
8.8
0%
Feb 20
WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability
Affected: through 9.1.1
CVE-2025-1028
8.1
1%
Feb 5
Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload
Affected: through 8.6.4
CVE-2026-32517
7.1
0%
Mar 25
WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability
Affected: through <= 9.1
CVE-2025-8783
4.4
0%
Aug 19
Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'
Affected: through 8.6.5
Showing 5