Contact Form 7

WordPress plugin · contact-form-7 · WordPress.org ↗

Latest v6.1.7 Last release Aug 17, 2026 Tested up to WP 7.1.1 10,000,000+ active installs

Critical

High

Known total

Unfixed

Running Contact Form 7 on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 10.0	Contact Form 7 [contact-form-7] < 5.3.2 WPVulnerability	< 5.3.2	v5.3.2	CVE-2020-35489	Dec 17, 2020
CRITICAL CVSS 9.8	Contact Form 7 [contact-form-7] < 5.0.4 WPVulnerability	< 5.0.4	v5.0.4	CVE-2018-20979	Sep 4, 2018
HIGH CVSS 7.2	Contact Form 7 [contact-form-7] < 5.8.4 WPVulnerability	< 5.8.4	v5.8.4	CVE-2023-6449	Nov 30, 2023
MEDIUM CVSS 4.7	Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect CVE.org	>=0, <2.5	v2.5	CVE-2026-14236	Jul 27, 2026
MEDIUM CVSS 5.3	Contact Form 7 [contact-form-7] < 6.0.6 WPVulnerability	< 6.0.6	v6.0.6	CVE-2025-3247	Apr 15, 2025
MEDIUM CVSS 6.1	Contact Form 7 [contact-form-7] < 5.9.5 WPVulnerability · PoC available	< 5.9.5	v5.9.5	CVE-2024-4704	Jun 5, 2024
MEDIUM CVSS 6.1	Contact Form 7 [contact-form-7] < 5.9.2 WPVulnerability	< 5.9.2	v5.9.2	CVE-2024-2242	Mar 13, 2024
NONE CVSS 0.0	Contact Form 7 [contact-form-7] < 3.7.2 WPVulnerability	< 3.7.2	v3.7.2	CVE-2014-2265	Feb 26, 2014
UNKNOWN	Contact Form 7 [contact-form-7] < 5.3.2 WPVulnerability	< 5.3.2	v5.3.2	—	Dec 17, 2020
UNKNOWN	Contact Form 7 [contact-form-7] < 5.0.4 WPVulnerability	< 5.0.4	v5.0.4	—	Sep 13, 2018
UNKNOWN	Contact Form 7 [contact-form-7] < 3.5.3 WPVulnerability	< 3.5.3	v3.5.3	—	Aug 1, 2014
UNKNOWN	Contact Form 7 [contact-form-7] < 3.5.3 WPVulnerability	< 3.5.3	v3.5.3	—	Aug 1, 2014
UNKNOWN	Contact Form 7 [contact-form-7] < 3.5.3 WPVulnerability	< 3.5.3	v3.5.3	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.