kleor Contact Manager
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-109218 | ≤ 9.1.2 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-32517 | n/a – <= 9.1 | WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability | HIGH 7.1 | 0.2 % | ||
| CVE-2025-68853 | ≤ 9.1.1 | WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability | HIGH 8.8 | 0.4 % | ||
| CVE-2025-8783 | ≤ 8.6.5 | Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title' | MEDIUM 4.4 | 0.3 % | ||
| CVE-2025-1028 | ≤ 8.6.4 | Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload | HIGH 8.1 | 0.8 % |