Known vulnerabilities in Database for Contact Form 7, WPforms, Elementor forms

Saves Contact Form 7, WPforms,Elementor Forms, CRM Perks Forms and many other contact form submissions to database.

19Reported vulnerabilities

9.8Highest CVSS score

1.5.5Latest version

60,000+Active installs

What to do now

Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.5 or later. 19 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 20, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-25080	Medium 6.1	84.2%	Before 1.1.7	`1.1.7`	January 24, 2022
CVE-2021-25079	Medium 6.1	6.8%	Before 1.2.4	`1.2.4`	January 24, 2022
CVE-2022-3604	High 7.8	0.4%	0 up to (but not including) 1.3.0	`1.3.0`	January 16, 2024
CVE-2025-7384	Critical 9.8	1.3%	0 to 1.4.3 (inclusive)	`1.4.4`	August 13, 2025
CVE-2026-2599	Critical 9.8	0.5%	0 to 1.4.7 (inclusive)	`1.4.8`	March 5, 2026
CVE-2023-31212	High 8.8	0.8%	1.3.0 and earlier	`1.3.1`	May 22, 2023
CVE-2026-9843	High 8.1	1.0%	0 to 1.5.1 (inclusive)	`1.5.2`	June 20, 2026
CVE-2026-12081	High 8.1	0.2%	1.5.1 and earlier	`1.5.2`	June 22, 2026
CVE-2024-1069	High 7.2	1.2%	Before 1.3.3	`1.3.3`	January 31, 2024
CVE-2026-57708	High 7.2	0.3%	1.5.2 and earlier	`1.5.3`	July 10, 2026
CVE-2024-3715	High 7.2	0.6%	1.3.8 and earlier	`1.3.9`	April 22, 2024
CVE-2026-14872	Medium 6.5	0.2%	1.5.4 and earlier	`1.5.5`	July 27, 2026
CVE-2026-9145	Medium 6.5	0.4%	0 to 1.5.1 (inclusive)	`1.5.2`	July 2, 2026
CVE-2024-2030	Medium 6.4	0.6%	0 to 1.3.3 (inclusive)	`1.3.4`	March 13, 2024
CVE-2023-33311	Medium 6.4	0.4%	1.3.0 and earlier	`1.3.1`	May 22, 2023
CVE-2026-14870	Medium 6.1	0.1%	1.5.2 and earlier	`1.5.3`	July 7, 2026
WF-83d46dce-b218-49ed-85ee-0e8d2a391eb9	Medium 6.1	—	1.2.0 and earlier	`1.2.1`	August 24, 2021
CVE-2026-0825	Medium 5.3	0.4%	0 to 1.4.5 (inclusive)	`1.4.6`	January 28, 2026
CVE-2026-3831	Medium 4.3	0.2%	0 to 1.4.9 (inclusive)	`1.5.0`	April 1, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.