Known vulnerabilities in Contact Form 7

Just another contact form plugin. Simple but flexible.

11Reported vulnerabilities

10Highest CVSS score

6.1.7Latest version

10,000,000+Active installs

What to do now

Update Contact Form 7 to 1.3.9.3 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2020-35489	Critical 10	89.3%	Before 5.3.2	`5.3.2`	December 17, 2020
CVE-2018-20979	Critical 9.8	2.0%	Before 5.0.4	`5.0.4`	August 22, 2019
CVE-2024-4704	Medium 6.1	0.4%	Before 5.9.5	`5.9.5`	June 27, 2024
WF-92298f2d-aced-4177-b6e8-36e153e9c930	Critical 9.8	—	3.5.2 and earlier	`3.5.3`	August 1, 2014
CVE-2021-24159	High 8.8	0.6%	3.1.9 and earlier	—	April 5, 2021
CVE-2023-6449	High 7.2	1.7%	Before 5.8.4	`5.8.4`	December 1, 2023
CVE-2024-2242	Medium 6.1	1.3%	Before 5.9.2	`5.9.2`	March 13, 2024
CVE-2014-2265	Medium 5.3	3.1%	Before 3.7.2	`3.7.2`	February 26, 2014
CVE-2025-14842	Medium 6.1	0.4%	0 to 1.3.9.2 (inclusive)	`1.3.9.3`	January 7, 2026
CVE-2025-3247	Medium 5.3	0.2%	Before 6.0.6	`6.0.6`	April 16, 2025
CVE-2023-6630	Medium 4.3	0.3%	4.1.0 and earlier	`4.2.0`	January 11, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.