Skip to contentUnknown Contact Form 7 vulnerabilities
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request CreationCVE-2026-1218735.3 Medium
- takayukister contact form 7Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenameCVE-2026-1144329.8 Critical
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug MetaboxCVE-2026-1115747.5 High
- unknown contact form 7 signature addonContact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email AttachmentsCVE-2026-1042465.9 Medium
- unknown click5 crm add-on to contact form 7click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notificationsCVE-2026-842618.8 High
- unknown click5 crm add-on to contact form 7click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options UpdateCVE-2026-842549.8 Critical
- unknown accept paypal payments using contact form 7Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV ExportCVE-2026-1059905.3 Medium
- unknown accept paypal payments using contact form 7Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status ForgeryCVE-2026-1059895.3 Medium
- unknown generate pdf using contact form 7WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerabilityCVE-2026-946667.5 High
- themefic ultra addons for contact form 7Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature FieldCVE-2026-847506.5 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form FieldCVE-2026-909845.8 Medium
- unknown contact form 7 captchaContact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationCVE-2026-851176.5 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-TagsCVE-2026-804394.8 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename BypassCVE-2026-187818.1 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag SettingCVE-2026-143253.5 Low
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id ParameterCVE-2026-148726.8 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idCVE-2026-148707.1 High
- takayukister contact form 7Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open RedirectCVE-2026-142364.7 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File FieldCVE-2026-120815.0 Medium
- glen don mongaya drag and drop multiple file upload – contact form 7WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-490557.1 High
- unknown spam protect for contact form 7Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code ExecutionCVE-2026-15407.2 High
- nysl spam protect for contact form 7WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerabilityCVE-2026-324966.8 Medium
- iambriansreed contact form 7 recaptchaContact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI']CVE-2025-82805.8 Medium
- brian s. reed contact form 7 recaptchaWordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-239724.3 Medium
- contact form 7 captcha project form 7 math captcha, dotsquares contact form 7 math captcha +1 moreContact Form 7 Math Captcha <= 2.0.1 - Reflected XSSCVE-2024-65176.1 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File DeletionCVE-2024-63178.8 High
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-63168.8 High
- unknown generate pdf using contact form 7WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerabilityCVE-2024-375559.6 Critical
- rocklobster contact form 7Contact Form 7 < 5.9.5 - Unauthenticated Open RedirectCVE-2024-47046.1 Medium
- florent73 send pdf for contact form 7, send pdf for contact form 7 project pdf for contact form 7 +1 moreSend PDF for Contact Form 7 <= 1.0.2.3 - Missing AuthorizationCVE-2024-35855.3 Medium
- ari soft contact form 7 connectorWordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2024-248844.3 Medium
- ari-soft contact form 7 connectorContact Form 7 Connector < 1.2.3 - Reflected XSSCVE-2024-02396.1 Medium
- codesmade autocomplete location field contact form 7, unknown autocomplete location field contact form 7 pro +1 moreAutocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site ScriptingCVE-2023-50054.8 Medium
- bannersky bsk contact form 7 blacklistBSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site ScriptingCVE-2023-51416.1 Medium
- themefic ultimate addons for contact form 7Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSSCVE-2023-28024.8 Medium
- themefic ultimate addons for contact form 7Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSSCVE-2023-28036.1 Medium
- crm perks integration for contact form 7 and zoho crm, bigin, crmperks integration for contact form 7 and zoho crm\, bigin +1 moreIntegration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLiCVE-2023-25274.8 Medium
- glen don l. mongaya drag and drop multiple file upload – contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreWordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2022-453645.4 Medium
- unknown drag and drop multiple file upload pro - contact form 7 standard, drag and drop multiple file upload pro - contact form 7 with remote storage integrations, codedropz drag and drop multiple file upload - contact form 7 +2 moreDrag and Drop Multiple File Upload PRO - Reflected Cross-Site ScriptingCVE-2023-12826.1 Medium
- unknown contact form 7 widget for elementor page builder & gutenberg blocks, hasthemes contact form 7 widget for elementor page builder \& gutenberg blocks +1 moreContact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRFCVE-2023-04844.3 Medium
- send pdf for contact form 7 project pdf for contact form 7, unknown send pdf for contact form 7 +1 moreSend PDF for Contact Form 7 < 0.9.9.2 - Contributor+ Stored XSS via ShortcodeCVE-2023-01435.4 Medium
- ciphercoin contact form 7 database addonContact Form 7 Database Addon < 1.2.6.5 - CSV InjectionCVE-2022-36349.8 Critical
- codedropz drag and drop multiple file upload - contact form 7, unknown drag and drop multiple file upload – contact form 7 +1 moreDrag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit BypassCVE-2022-32824.3 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site ScriptingCVE-2022-30704.8 Medium
- contact form 7 captcha project form 7 captcha, unknown contact form 7 captcha +1 moreContact Form 7 Captcha < 0.1.2 - Reflected Cross-Site ScriptingCVE-2022-21876.1 Medium
- jquery validation for contact form 7 project validation for contact form 7, unknown jquery validation for contact form 7 +1 moreJquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRFCVE-2022-21444.3 Medium
- redirection-for-contact-form7 redirection for contact form 7Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site ScriptingCVE-2022-02506.1 Medium
- material design for contact form 7 project design for contact form 7, unknown material design for contact form 7 +1 moreMaterial Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoSCVE-2022-04046.5 Medium
- codedropz drag and drop multiple file upload - contact form 7, unknown drag and drop multiple file upload – contact form 7 +1 moreDrag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSCVE-2022-0595EPSS 13.5%5.4 Medium
- unknown advanced contact form 7 db, vsourz advanced cf7 db +1 moreAdvanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File DeletionCVE-2021-249058.0 High
- Show olderLoading…