Known vulnerabilities in Advanced Contact form 7 DB

Save all contact form 7 form submitted data to the database, View, Ordering, Change field labels and Import/Export data using CSV.

10Reported vulnerabilities

9.8Highest CVSS score

2.1.3Latest version

70,000+Active installs

What to do now

Update Advanced Contact form 7 DB to 2.1.0 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 21, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2019-13571	Critical 9.8	4.0%	1.6.1 and earlier	`1.7.0`	July 29, 2019
CVE-2021-24905	High 8	0.8%	Before 1.8.7	`1.8.7`	March 21, 2022
WF-bf70f652-5244-421c-8ee6-75719315ed64	High 8.5	—	Before 1.6.1	`1.6.1`	April 11, 2019
CVE-2022-29408	Medium 6.1	0.7%	1.8.7 and earlier	`1.8.8`	May 25, 2022
CVE-2026-0811	Medium 5.4	0.1%	0 to 2.0.9 (inclusive)	`2.1.0`	April 8, 2026
CVE-2024-4319	Medium 5.3	0.5%	0 to 2.0.2 (inclusive)	`2.0.3`	June 11, 2024
CVE-2024-3723	Medium 5.3	0.4%	0 to 2.0.2 (inclusive) 0 to 2.0.2 (inclusive)	`2.0.3`	June 11, 2024
CVE-2026-57669	Medium 4.3	0.3%	2.0.9 and earlier	`2.1.0`	June 30, 2026
CVE-2026-0814	Medium 4.3	0.3%	0 to 2.0.9 (inclusive)	`2.1.0`	April 8, 2026
CVE-2014-2054	Low 3.7	1.5%	2.0.8 and earlier	`2.0.9`	April 7, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.