Plugin icon

Contact Form 7 – PayPal & Stripe Add-on

contact-form-7-paypal-add-on

Vulnerabilities:

9

Last Updated:

October 7, 2026

Active Installs:

7000

Published
Title
Fixed in
CVSS
Published
2026-08-11
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.5.2 - Missing Authorization
Fixed in
Fixed in 2.5.2
CVSS
5.3 (medium)
Published
2026-07-06
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
Fixed in
Fixed in 2.5
CVSS
4.7 (medium)
Published
2026-05-28
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.4.10 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Fixed in
Fixed in 2.4.10
CVSS
5.3 (medium)
Published
2025-05-07
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.1
CVSS
4.4 (medium)
Published
2024-11-08
Title
Contact Form 7 - PayPal & Stripe Add-on < 2.3.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.3.2
CVSS
6.1 (medium)
Published
2024-10-08
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.3.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.3.1
CVSS
6.1 (medium)
Published
2024-03-16
Title
Contact Form 7 – PayPal & Stripe Add-on < 2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.1
CVSS
6.1 (medium)
Published
2024-02-27
Title
Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update
Fixed in
Fixed in 2.2
CVSS
4.3 (medium)
Published
2023-03-17
Title
Contact Form 7 – PayPal & Stripe Add-on < 1.9.4 - Cross-Site Request Forgery
Fixed in
Fixed in 1.9.4
CVSS
5.4 (medium)