CVE-2025-9944

Name of the Vulnerable Software and Affected Versions Professional Contact Form plugin for WordPress versions prior to 1.0.1

Description The Professional Contact Form plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of proper nonce validation within the watch for contact form submit function. An unauthenticated attacker could potentially trigger a test email sending action by forging a request, provided they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update the Professional Contact Form plugin to version 1.0.1 or later.