Plugin icon

Contact Form 7

contact-form-7

Vulnerabilities:

8

Last Updated:

November 30, 2025

Active Installs:

10000000

Published
Title
Fixed in
CVSS
Published
2025-04-15
Title
Contact Form 7 < 6.0.6 - Order Replay Vulnerability
Fixed in
Fixed in 6.0.6
CVSS
5.3 (medium)
Published
2024-06-05
Title
Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect
Fixed in
Fixed in 5.9.5
CVSS
4.3 (medium)
Published
2024-03-13
Title
Contact Form 7 < 5.9.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.9.2
CVSS
6.1 (medium)
Published
2023-11-30
Title
Contact Form 7 < 5.8.4 - Authenticated (Editor+) Arbitrary File Upload
Fixed in
Fixed in 5.8.4
CVSS
6.6 (medium)
Published
2020-12-17
Title
Contact Form 7 < 5.3.2 - Unrestricted File Upload
Fixed in
Fixed in 5.3.2
CVSS
8.1 (high)
Published
2018-09-04
Title
Contact Form 7 <= 5.0.3 - register_post_type() Privilege Escalation
Fixed in
Fixed in 5.0.4
CVSS
9.8 (critical)
Published
2014-08-01
Title
Contact Form 7 <= 3.5.2 - File Upload Remote Code Execution
Fixed in
Fixed in 3.5.3
CVSS
n/a
Published
2014-08-01
Title
Contact Form 7 <= 3.7.1 - CAPTCHA Bypass
Fixed in
Fixed in 3.7.2
CVSS
n/a