Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-23
CVE-2025-14800 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.
PLUGIN
Redirection For Contact Form 7
CVE-2025-14800
Risk Score
Threat Entry
Updated 2025-10-21
CVE-2025-9562 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Redirection For Contact Form 7
CVE-2025-9562
Risk Score
Threat Entry
Updated 2025-08-20
CVE-2025-8289 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to…
PLUGIN
Redirection For Contact Form 7
CVE-2025-8289
Risk Score
Threat Entry
Updated 2025-08-20
CVE-2025-8145 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
PLUGIN
Redirection For Contact Form 7
CVE-2025-8145
Risk Score
Threat Entry
Updated 2025-08-20
CVE-2025-8141 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Redirection For Contact Form 7
CVE-2025-8141
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36913 - Redirection For Contact Form 7 Plugin
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin
PLUGIN
Redirection For Contact Form 7
CVE-2021-36913
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0250 - Redirection For Contact Form 7 Plugin
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
PLUGIN
Redirection For Contact Form 7
CVE-2022-0250
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24280 - Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24280
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24278 - Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24278
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24279 - Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24279
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24282 - Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24282
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24281 - Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24281
Risk Score