Threat Database (107)

Threat Entry Updated 2026-06-17

Contact Form 7 - Information Disclosure (CVE-2025-53309)

Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2025-53309

MEDIUM CVSS 5.3 2025-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Broken Access Control (CVE-2025-53304)

Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through

PLUGIN Contact Form 7

CVE-2025-53304

MEDIUM CVSS 5.3 2025-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Broken Access Control (CVE-2025-52817)

Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2025-52817

HIGH CVSS 8.2 2025-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - PHP Object Injection (CVE-2025-49330)

Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through

PLUGIN Contact Form 7

CVE-2025-49330

CRITICAL CVSS 9.8 2025-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-47626)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2025-47626

MEDIUM CVSS 5.9 2025-05-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-47518)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Stored XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through

PLUGIN Contact Form 7

CVE-2025-47518

MEDIUM CVSS 5.9 2025-05-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Improper Input Validation (CVE-2025-3247)

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

PLUGIN Contact Form 7

CVE-2025-3247

MEDIUM CVSS 5.3 2025-04-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Open Redirect (CVE-2025-31821)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.

PLUGIN Contact Form 7

CVE-2025-31821

MEDIUM CVSS 4.7 2025-04-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-31101)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.

PLUGIN Contact Form 7

CVE-2025-31101

MEDIUM CVSS 5.9 2025-03-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Request Forgery (CSRF) (CVE-2025-30863)

Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through

PLUGIN Contact Form 7

CVE-2025-30863

MEDIUM CVSS 4.3 2025-03-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-26544)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracking allows Reflected XSS.This issue affects UTM tags tracking for Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2025-26544

HIGH CVSS 7.1 2025-03-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Request Forgery (CSRF) (CVE-2025-28902)

Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through

PLUGIN Contact Form 7

CVE-2025-28902

MEDIUM CVSS 4.3 2025-03-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-27304)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through

THEME Contact Form 7

CVE-2025-27304

MEDIUM CVSS 5.9 2025-02-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-27303)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-star-rating allows Stored XSS.This issue affects Contact Form 7 Star Rating: from n/a through

PLUGIN Contact Form 7

CVE-2025-27303

MEDIUM CVSS 5.9 2025-02-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-23655)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paystack-add-on allows Reflected XSS.This issue affects Contact Form 7 – Paystack Add-on: from n/a through

PLUGIN Contact Form 7

CVE-2025-23655

HIGH CVSS 7.1 2025-02-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-24726)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2025-24726

MEDIUM CVSS 6.5 2025-01-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-23812)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows Reflected XSS.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through

PLUGIN Contact Form 7

CVE-2025-23812

HIGH CVSS 7.1 2025-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - SQL Injection (CVE-2025-23784)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through

PLUGIN Contact Form 7

CVE-2025-23784

HIGH CVSS 7.6 2025-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-23623)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through

PLUGIN Contact Form 7

CVE-2025-23623

HIGH CVSS 7.1 2025-01-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Contact Form 7 - Broken Access Control (CVE-2023-47693)

Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through

PLUGIN Contact Form 7

CVE-2023-47693

HIGH CVSS 7.5 2025-01-02

Risk Score

Open Full Technical Breakdown