WordPress contact-form has 14 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-24276 | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in | medium | 6.1 | <1.7.15 | 1.7.15 |
| CVE-2022-3463 | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a | critical | 9.8 | <4.3.13 | 4.3.13 |
| CVE-2021-24689 | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files | medium | 4.9 | <=1.0.5 | – |
| CVE-2021-24777 | The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter whic | high | 7.2 | <1.3 | 1.3 |
| CVE-2023-24410 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Conta | medium | 5.5 | <=4.3.25 | – |
| CVE-2019-25145 | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.p | high | 7.2 | <=2.5.1 | – |
| CVE-2021-24381 | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, w | medium | 4.8 | <3.5.8.2 | 3.5.8.2 |
| CVE-2014-125095 | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the | low | 3.5 | =1.3.4 | – |
| CVE-2013-10022 | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this | low | 3.5 | =3.51 | – |
| CVE-2023-0546 | The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom | medium | 5.4 | <4.3.25 | 4.3.25 |
| CVE-2024-9651 | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 6.1 | <5.2.1 | 5.2.1 |
| CVE-2024-11273 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, | medium | 6.1 | <2.6.0 | 2.6.0 |
| CVE-2024-2772 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross | medium | 6.4 | <5.1.14 | 5.1.14 |
| CVE-2025-5730 | The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege u | medium | 4.3 | <1.1.29 | 1.1.29 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked