WordPress plugin
Contact Forms by Cimatti security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium9
- Low0
All Contact Forms by Cimatti vulnerabilities
- Medium4.3Cross-Site Request Forgery
≤1.9.8Update to 1.9.9
- Medium5.3Missing Authorization to Unauthenticated Form Submission Download
≤1.9.4Update to 1.9.5
- Medium4.3Cross-Site Request Forgery via process_bulk_action Function
≤1.9.2Update to 1.9.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.0Update to 1.9.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.7.0Update to 1.8.0
- Medium4.3Cross-Site Request Forgery via accua_forms_list_page_table
≤1.6.0Update to 1.6.1
- Medium4.3Missing Authorization
≤1.5.7Update to 1.5.8
- Medium4.3Cross-Site Request Forgery via _accua_forms_form_edit_action
≤1.5.7Update to 1.5.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.5.4Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters
≤1.5.4Update to 1.5.5
- Medium5.5Cross-Site Scripting
<1.4.12Update to 1.4.12
Contact Forms by Cimatti: common questions
Does Contact Forms by Cimatti have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in Contact Forms by Cimatti: 2 high, 9 medium. None are known to affect version null.
How do I check which version of Contact Forms by Cimatti I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Contact Forms by Cimatti vulnerability?
CVE-2025-49069, published Jun 2, 2025: Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any Contact Forms by Cimatti vulnerability listed in CISA KEV?
No. None of the known Contact Forms by Cimatti vulnerabilities is currently listed in the CISA KEV catalog.