Is Redirection for Contact Form 7 safe?

Every recorded flaw

• Oct 21, 2026Redirection for Contact Form 7: Does not sanitise or escape submitted form data storedCVE-2026-111574 · fixed in 3.2.12 · reported by WPScanHigh 7.5
• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.CVE-2026-23970 · affects up to 3.2.8 · reported by PatchstackHigh 7.1
• Dec 21, 2025Redirection for Contact Form 7: Arbitrary file uploadsCVE-2025-14800 · affects up to 3.2.7 · reported by WordfenceHigh 8.1
• Oct 18, 2025Redirection for Contact Form 7: Stored Cross-Site ScriptingCVE-2025-9562 · affects up to 3.2.6 · reported by WordfenceMedium 6.4
• Aug 19, 2025Redirection for Contact Form 7: PHP Object InjectionCVE-2025-8289 · affects up to 3.2.4 · reported by WordfenceHigh 7.5
• Aug 19, 2025Redirection for Contact Form 7: PHP Object InjectionCVE-2025-8145 · affects up to 3.2.4 · reported by WordfenceHigh 8.8
• Aug 19, 2025Redirection for Contact Form 7: Arbitrary file deletionCVE-2025-8141 · affects up to 3.2.4 · reported by WordfenceHigh 8.8
• Dec 13, 2024Redirection for Contact Form 7: Missing AuthorizationCVE-2023-39920 · affects up to 2.9.2 · reported by PatchstackHigh 7.5
• May 17, 2024Redirection for Contact Form 7: Improper Privilege ManagementCVE-2023-23990 · affects up to 2.7.0 · reported by PatchstackHigh 7.6
• Oct 11, 2022Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at: Unauthenticated Options Change and Content InjectionCVE-2021-36913 · affects up to 2.4.0 · reported by PatchstackHigh 7.5
• Jul 4, 2022Redirection for Contact Form 7: Does not escape a link generated before outputting it in an attributeCVE-2022-0250 · fixed in 2.5.0 · reported by WPScan1.6% oddsMedium 6.1
• May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pluCVE-2021-24282 · fixed in 2.3.4 · reported by WPScanMedium 6.3
• May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action CVE-2021-24281 · fixed in 2.3.4 · reported by WPScanMedium 4.3
• May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action tCVE-2021-24280 · fixed in 2.3.4 · reported by WPScan2.0% oddsHigh 8.8
• May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to instalCVE-2021-24279 · fixed in 2.3.4 · reported by WPScanMedium 6.5
• May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce foCVE-2021-24278 · fixed in 2.3.4 · reported by WPScan7.4% oddsHigh 7.5

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.