Plugin icon

Contact Form to Any API

contact-form-to-any-api

Vulnerabilities:

7

Last Updated:

August 6, 2026

Active Installs:

8000

Published
Title
Fixed in
CVSS
Published
2026-08-06
Title
Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
Fixed in
Fixed in 3.0.7
CVSS
5.3 (medium)
Published
2026-07-28
Title
Contact Form to Any API < 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta
Fixed in
Fixed in 3.0.7
CVSS
5.5 (medium)
Published
2026-04-22
Title
Contact Form to Any API < 3.0.4 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.0.4
CVSS
7.2 (high)
Published
2024-09-24
Title
Contact Form to Any API < 1.2.5 - Unauthenticated Stored Cross-Site Scripting via Contact Form
Fixed in
Fixed in 1.2.5
CVSS
7.2 (high)
Published
2024-03-26
Title
Contact Form to Any API < 1.1.9 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.1.9
CVSS
9.9 (critical)
Published
2023-11-20
Title
Contact Form to Any API < 1.1.7 - Subscriber+ API Entry Record Deletion
Fixed in
Fixed in 1.1.7
CVSS
5.3 (medium)
Published
2023-07-17
Title
Contact Form to Any API < 1.1.3 - Admin+ SQLi
Fixed in
Fixed in 1.1.3
CVSS
4.1 (medium)