Known vulnerabilities in Redirection for Contact Form 7

Redirect to any page or URL, execute scripts after submission, save data to the database, and unlock additional submission actions for Contact Form 7.

9Reported vulnerabilities

8.8Highest CVSS score

3.2.10Latest version

200,000+Active installs

What to do now

Update Redirection for Contact Form 7 to 3.2.9 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 19, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2025-8145	High 8.8	0.5%	0 to 3.2.4 (inclusive)	`3.2.5`	August 20, 2025
CVE-2025-8141	High 8.8	0.6%	0 to 3.2.4 (inclusive)	`3.2.5`	August 20, 2025
CVE-2025-14800	High 8.1	0.4%	0 to 3.2.7 (inclusive)	`3.2.8`	December 21, 2025
CVE-2021-36913	High 7.5	0.6%	Before 2.6.0	`2.6.0`	October 11, 2022
CVE-2025-8289	High 7.5	0.4%	0 to 3.2.4 (inclusive)	`3.2.5`	August 20, 2025
CVE-2023-23990	High 7.2	0.7%	2.7.0 and earlier	`2.8.0`	February 6, 2023
CVE-2026-23970	High 7.2	0.2%	3.2.8 and earlier	`3.2.9`	May 13, 2026
CVE-2025-9562	Medium 6.4	0.3%	0 to 3.2.6 (inclusive)	`3.2.7`	October 18, 2025
CVE-2023-39920	Medium 5.3	0.6%	2.9.2 and earlier	`3.0.0`	October 3, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.