Is Generate PDF using Contact Form 7 safe?

Every recorded flaw

• Oct 9, 2026Generate PDF using Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94666 · affects up to 4.2.1 · reported by PatchstackHigh 7.5
• Sep 18, 2026Generate PDF using Contact Form 7: Does not restrict the destination of the image fetch its PDF renderer performs on submitted form contentCVE-2026-90984 · fixed in 4.2.2 · reported by WPScanMedium 5.8
• Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6317 · affects up to 4.1.2 · reported by WordfenceHigh 8.8
• Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6316 · affects up to 4.1.2 · reported by WordfenceHigh 8.8
• Jul 9, 2024Generate PDF using Contact Form 7: Unrestricted Upload of File with Dangerous TypeCVE-2024-37555 · affects up to 4.1.2 · reported by PatchstackCritical 9.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.