Threat Entry Updated 2025-12-23

CVE-2025-14800 - Wpcf7 Redirect Plugin

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.

PLUGIN Wpcf7 Redirect

CVE-2025-14800

HIGH CVSS 8.1 2025-12-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-10-21

CVE-2025-9562 - Wpcf7 Redirect Plugin

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wpcf7 Redirect

CVE-2025-9562

MEDIUM CVSS 6.4 2025-10-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-08-20

CVE-2025-8289 - Wpcf7 Redirect Plugin

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to…

PLUGIN Wpcf7 Redirect

CVE-2025-8289

HIGH CVSS 7.5 2025-08-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-08-20

CVE-2025-8145 - Wpcf7 Redirect Plugin

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible

PLUGIN Wpcf7 Redirect

CVE-2025-8145

HIGH CVSS 8.8 2025-08-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-08-20

CVE-2025-8141 - Wpcf7 Redirect Plugin

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

PLUGIN Wpcf7 Redirect

CVE-2025-8141

HIGH CVSS 8.8 2025-08-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-36913 - Wpcf7 Redirect Plugin

Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin

PLUGIN Wpcf7 Redirect

CVE-2021-36913

HIGH CVSS 7.5 2022-10-11

Risk Score

Open Full Technical Breakdown