Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Wpcf7 Redirect - Security Vulnerability (CVE-2026-120659)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on…
PLUGIN
Wpcf7 Redirect
CVE-2026-120659
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Security Vulnerability (CVE-2025-14800)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.
PLUGIN
Wpcf7 Redirect
CVE-2025-14800
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Cross-Site Scripting (XSS) (CVE-2025-9562)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpcf7 Redirect
CVE-2025-9562
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Arbitrary File Upload (CVE-2025-8289)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to…
PLUGIN
Wpcf7 Redirect
CVE-2025-8289
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Remote Code Execution (CVE-2025-8145)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
PLUGIN
Wpcf7 Redirect
CVE-2025-8145
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Remote Code Execution (CVE-2025-8141)
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Wpcf7 Redirect
CVE-2025-8141
Risk Score
Threat Entry
Updated 2026-06-17
Wpcf7 Redirect - Security Vulnerability (CVE-2021-36913)
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin
PLUGIN
Wpcf7 Redirect
CVE-2021-36913
Risk Score