WordPress plugin
Redirection for Contact Form 7 security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High9
- Medium12
- Low0
All Redirection for Contact Form 7 vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization <3.2.16Update to 3.2.16 | CVE-2026-121873 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter ≤3.2.14Update to 3.2.15 | CVE-2026-120659 | |
| High7.2 | 3.2.11 - Unauthenticated Stored Cross-Site Scripting 2.2.7 – 3.2.11Update to 3.2.12 | CVE-2026-111574 | |
| Medium6.5 | 3.2.10 - Unauthenticated Arbitrary Shortcode Execution 2.2.7 – 3.2.10Update to 3.2.11 | CVE-2026-80439 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.2.8Update to 3.2.9 | CVE-2026-23970 | |
| High8.1 | Unauthenticated Arbitrary File Copy via move_file_to_upload ≤3.2.7Update to 3.2.8 | CVE-2025-14800 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode ≤3.2.6Update to 3.2.7 | CVE-2025-9562 | |
| High8.8 | Unauthenticated Arbitrary File Deletion ≤3.2.4Update to 3.2.5 | CVE-2025-8141 | |
| High7.5 | Unauthenticated PHP Object Injection via PHAR Deserialization ≤3.2.4Update to 3.2.5 | CVE-2025-8289 | |
| High8.8 | Unauthenticated PHP Object Injection ≤3.2.4Update to 3.2.5 | CVE-2025-8145 | |
| Medium5.3 | Missing Authorization ≤2.9.2Update to 3.0.0 | CVE-2023-39920 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 | |
| High7.2 | Authenticated(Editor+) Privilege Escalation ≤2.7.0Update to 2.8.0 | CVE-2023-23990 | |
| Medium5.3 | Missing Authorization ≤2.4.0Update to 2.7.0 | CVE-2021-36913 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.4.0Update to 2.5.0 | CVE-2022-0250 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 | |
| High8.8 | Authenticated PHP Object Injection <2.3.4Update to 2.3.4 | CVE-2021-24280 | |
| Medium6.5 | Authenticated Arbitrary Plugin Installation <2.3.4Update to 2.3.4 | CVE-2021-24279 | |
| Medium4.3 | Authenticated Arbitrary Post Deletion <2.3.4Update to 2.3.4 | CVE-2021-24281 | |
| High7.5 | Unauthenticated Arbitrary Nonce Generation <2.3.4Update to 2.3.4 | CVE-2021-24278 | |
| Medium6.3 | Unprotected AJAX Actions <2.3.4Update to 2.3.4 | CVE-2021-24282 |
- Medium5.3Missing Authorization
<3.2.16Update to 3.2.16
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter
≤3.2.14Update to 3.2.15
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
2.2.7 – 3.2.11Update to 3.2.12
- Medium6.53.2.10 - Unauthenticated Arbitrary Shortcode Execution
2.2.7 – 3.2.10Update to 3.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.2.8Update to 3.2.9
- High8.1Unauthenticated Arbitrary File Copy via move_file_to_upload
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
≤3.2.6Update to 3.2.7
- High8.8Unauthenticated Arbitrary File Deletion
≤3.2.4Update to 3.2.5
- High7.5Unauthenticated PHP Object Injection via PHAR Deserialization
≤3.2.4Update to 3.2.5
- High8.8Unauthenticated PHP Object Injection
≤3.2.4Update to 3.2.5
- Medium5.3Missing Authorization
≤2.9.2Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- High7.2Authenticated(Editor+) Privilege Escalation
≤2.7.0Update to 2.8.0
- Medium5.3Missing Authorization
≤2.4.0Update to 2.7.0
- Medium6.1Reflected Cross-Site Scripting
≤2.4.0Update to 2.5.0
- Medium6.3Missing Authorization Checks
all versionsNo patch available
- High8.8Authenticated PHP Object Injection
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
<2.3.4Update to 2.3.4
- Medium4.3Authenticated Arbitrary Post Deletion
<2.3.4Update to 2.3.4
- High7.5Unauthenticated Arbitrary Nonce Generation
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
<2.3.4Update to 2.3.4
Redirection for Contact Form 7: common questions
Does Redirection for Contact Form 7 have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Redirection for Contact Form 7: 9 high, 12 medium. At least one is not fixed in the latest version.
How do I check which version of Redirection for Contact Form 7 I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Redirection for Contact Form 7 vulnerability?
CVE-2026-121873, published Nov 11, 2026: Redirection for Contact Form 7 < 3.2.16 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Redirection for Contact Form 7 vulnerability listed in CISA KEV?
No. None of the known Redirection for Contact Form 7 vulnerabilities is currently listed in the CISA KEV catalog.