Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-24
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2022-50960)
WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.
PLUGIN
Contact Form 7
CVE-2022-50960
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2026-5710)
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without performing any server-side upload provenance check, path canonicalization, or directory containment boundary enforcement. In dnd_wpcf7_posted_data(), each user-submitted filename is directly appended to the plugin's upload URL without sanitization. In dnd_cf7_mail_components(), the URL is converted back to a filesystem…
PLUGIN
Contact Form 7
CVE-2026-5710
Risk Score
Threat Entry
Updated 2026-07-24
Contact Form 7 - Broken Access Control (CVE-2026-39707)
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-39707
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Broken Access Control (CVE-2026-32527)
Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through
PLUGIN
Contact Form 7
CVE-2026-32527
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Path Traversal (CVE-2026-32496)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Contact Form 7 wp-contact-form-7-spam-blocker allows Path Traversal.This issue affects Spam Protect for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-32496
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Broken Access Control (CVE-2026-25430)
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through
PLUGIN
Contact Form 7
CVE-2026-25430
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Broken Access Control (CVE-2026-24945)
Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-24945
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2025-14457)
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
PLUGIN
Contact Form 7
CVE-2025-14457
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2025-14842)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute…
PLUGIN
Contact Form 7
CVE-2025-14842
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2025-64231)
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through
PLUGIN
Contact Form 7
CVE-2025-64231
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2025-53283)
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through
PLUGIN
Contact Form 7
CVE-2025-53283
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Broken Access Control (CVE-2025-62915)
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through
PLUGIN
Contact Form 7
CVE-2025-62915
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-60169)
Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through
PLUGIN
Contact Form 7
CVE-2025-60169
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-58989)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2025-58989
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Arbitrary File Upload (CVE-2025-8289)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to…
PLUGIN
Contact Form 7
CVE-2025-8289
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-54684)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact cf7-constant-contact allows Stored XSS.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through
PLUGIN
Contact Form 7
CVE-2025-54684
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2025-7384)
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
PLUGIN
Contact Form 7
CVE-2025-7384
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2025-7697)
The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php…
PLUGIN
Contact Form 7
CVE-2025-7697
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Remote Code Execution (CVE-2025-7696)
The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file…
PLUGIN
Contact Form 7
CVE-2025-7696
Risk Score
Threat Entry
Updated 2026-06-17
Contact Form 7 - Information Disclosure (CVE-2025-53322)
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2025-53322
Risk Score