WordPress contact-form-7 has 6 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-35489 KEV | Unrestricted file upload via unsanitised filenames (double extension) | critical | 10.0 | <5.3.2 | 5.3.2 |
| CVE-2018-20979 | The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type. | critical | 9.8 | <5.0.4 | 5.0.4 |
| CVE-2023-6449 | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' f | medium | 6.6 | <5.8.4 | 5.8.4 |
| CVE-2024-2242 | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to | medium | 6.1 | <5.9.2 | 5.9.2 |
| CVE-2024-4704 | The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL | medium | 6.1 | <5.9.5 | 5.9.5 |
| CVE-2025-3247 | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip | medium | 5.3 | <6.0.6 | 6.0.6 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked