WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
cf7-database
Published
2024-03-15
Title
Database for Contact Form 7 < 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cf7-dynamics-crm
Published
2025-01-27
Title
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.7 - Reflected Cross-Site Scripting
Slug
cf7-easy-math-captcha
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cf7-editor-button
Published
2025-07-07
Title
Contact Form 7 Editor Button <= 1.0.0 - Reflected Cross-Site Scripting
Slug
cf7-email-add-on
Published
2024-11-20
Title
Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion
Slug
cf7-field-validation
Published
2023-08-17
Title
Contact form 7 Custom validation <= 1.1.3 - Unauthenticated SQLi
Slug
cf7-file-download
Published
2024-04-26
Title
CF7 File Download – File Download for CF7 <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
cf7-google-sheets-connector
Published
2023-06-12
Title
CF7 Google Sheets Connector (Free < 5.0.2, Pro < 2.3.7) - Reflected XSS
Slug
cf7-google-sheets-connector
Published
2023-11-30
Title
CF7 Google Sheets Connector < 5.0.6 - Unauthenticated Sensitive Information Exposure via Debug Log
Slug
cf7-google-sheets-connector
Published
2024-06-07
Title
CF7 Google Sheets Connector < 5.0.10 - Missing Authorization to Limited Site Configuration Update
Slug
cf7-google-sheets-connector
Published
2025-01-31
Title
CF7 Google Sheets Connector < 5.0.18 - Missing Authorization
Slug
cf7-google-sheets-connector
Published
2026-07-31
Title
GSheetConnector < 5.2.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Slug
cf7-google-sheets-connector-pro
Published
2023-06-12
Title
CF7 Google Sheets Connector (Free < 5.0.2, Pro < 2.3.7) - Reflected XSS
Slug
cf7-grid-and-styler-for-divi
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cf7-grid-and-styler-for-divi
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cf7-hubspot
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
cf7-hubspot
Published
2024-05-14
Title
Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery
Slug
cf7-hubspot
Published
2025-12-25
Title
Integration for Contact Form 7 HubSpot < 1.4.3 - Authenticated (Administrator+) SQL Injection
Slug
cf7-hubspot
Published
2026-01-22
Title
Integration for Contact Form 7 HubSpot < 1.4.4 - Authenticated (Subscriber+) Information Exposure
Slug
cf7-hubspot
Published
2026-06-04
Title
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms < 1.3.8 - Unauthenticated PHP Object Injection
Slug
cf7-infusionsoft
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
cf7-infusionsoft
Published
2026-06-05
Title
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms < 1.2.2 - Unauthenticated PHP Object Injection
Slug
cf7-insightly
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
cf7-insightly
Published
2026-03-20
Title
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.6 - Missing Authorization
Slug
cf7-insightly
Published
2026-06-05
Title
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.5 - Unauthenticated PHP Object Injection