Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-08
Redirection for Contact Form 7 - Security Vulnerability (CVE-2026-80439)
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
PLUGIN
Redirection for Contact Form 7
CVE-2026-80439
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2026-23970)
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7
PLUGIN
Redirection for Contact Form 7
CVE-2026-23970
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Security Vulnerability (CVE-2025-14800)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.
PLUGIN
Redirection for Contact Form 7
CVE-2025-14800
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2025-9562)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Redirection for Contact Form 7
CVE-2025-9562
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Arbitrary File Upload (CVE-2025-8289)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to…
THEME
Redirection for Contact Form 7
CVE-2025-8289
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Remote Code Execution (CVE-2025-8145)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
THEME
Redirection for Contact Form 7
CVE-2025-8145
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Remote Code Execution (CVE-2025-8141)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
THEME
Redirection for Contact Form 7
CVE-2025-8141
Risk Score
Threat Entry
Updated 2026-06-17
Redirection for Contact Form 7 - Cross-Site Request Forgery (CSRF) (CVE-2022-4974)
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
THEME
Redirection for Contact Form 7
CVE-2022-4974
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-36913)
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin
PLUGIN
Redirection For Contact Form 7
CVE-2021-36913
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Cross-Site Scripting (XSS) (CVE-2022-0250)
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
PLUGIN
Redirection For Contact Form 7
CVE-2022-0250
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-24280)
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24280
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-24278)
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24278
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-24279)
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24279
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-24282)
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24282
Risk Score
Threat Entry
Updated 2026-06-17
Redirection For Contact Form 7 - Security Vulnerability (CVE-2021-24281)
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
PLUGIN
Redirection For Contact Form 7
CVE-2021-24281
Risk Score