Is Database for Contact Form 7, WPforms, Elementor forms safe?

Every recorded flaw

• Aug 4, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-14872 · fixed in 1.5.5 · reported by WPScanMedium 6.8
• Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · fixed in 1.5.3 · reported by WPScanHigh 7.1
• Jul 13, 2026Contact Form Entries: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57708 · affects up to 1.5.2 · reported by PatchstackHigh 7.1
• Jul 13, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not restrict the PHP classes allowedCVE-2026-12081 · fixed in 1.5.2 · reported by WPScanMedium 5
• Jul 2, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary File CopyCVE-2026-9145 · affects up to 1.5.1 · reported by WordfenceMedium 6.5
• Jun 19, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary file deletionCVE-2026-9843 · affects up to 1.5.1 · reported by Wordfence1.0% oddsHigh 8.1
• Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · affects up to 1.4.9 · reported by WordfenceMedium 4.3
• Mar 5, 2026Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2026-2599 · affects up to 1.4.7 · reported by WordfenceCritical 9.8
• Jan 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Authorization bypassCVE-2026-0825 · affects up to 1.4.5 · reported by WordfenceMedium 5.3
• Aug 13, 2025Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2025-7384 · affects up to 1.4.3 · reported by Wordfence1.3% oddsCritical 9.8
• May 2, 2024Database for Contact Form 7, WPforms, Elementor forms: Stored Cross-Site ScriptingCVE-2024-3715 · affects up to 1.3.8 · reported by WordfenceHigh 7.2
• Mar 13, 2024Database for Contact Form 7, WPforms, Elementor forms: Stored Cross-Site ScriptingCVE-2024-2030 · affects up to 1.3.3 · reported by WordfenceMedium 6.4
• Jan 30, 2024Contact Form Entries: Arbitrary file uploadsCVE-2024-1069 · affects up to 1.3.2 · reported by Wordfence1.2% oddsHigh 7.2
• Jan 16, 2024Contact Form Entries: Does not validate dataCVE-2022-3604 · fixed in 1.3.0 · reported by WPScanHigh 7.8
• Oct 31, 2023Database for Contact Form 7, WPforms, Elementor forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31212 · affects up to 1.3.0 · reported by PatchstackHigh 8.5
• May 28, 2023Auth.CVE-2023-33311 · affects up to 1.3.0 · reported by PatchstackMedium 6.5
• Jan 24, 2022Contact Form Entries: Does not validateCVE-2021-25080 · fixed in 1.1.7 · reported by WPScan84% oddsMedium 6.1
• Jan 24, 2022Contact Form Entries: Does not sanitise and escape various parametersCVE-2021-25079 · fixed in 1.2.4 · reported by WPScan6.8% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.