WordPress plugin
Redirection for Contact Form 7 security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High9
- Medium12
- Low0
All Redirection for Contact Form 7 vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | 3.2.11 - Unauthenticated Stored Cross-Site Scripting 2.2.7 – 3.2.11Update to 3.2.12 | CVE-2026-111574 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.2.8Update to 3.2.9 | CVE-2026-23970 | |
| High8.1 | Unauthenticated Arbitrary File Copy via move_file_to_upload ≤3.2.7Update to 3.2.8 | CVE-2025-14800 | |
| High8.8 | Unauthenticated Arbitrary File Deletion ≤3.2.4Update to 3.2.5 | CVE-2025-8141 | |
| High7.5 | Unauthenticated PHP Object Injection via PHAR Deserialization ≤3.2.4Update to 3.2.5 | CVE-2025-8289 | |
| High8.8 | Unauthenticated PHP Object Injection ≤3.2.4Update to 3.2.5 | CVE-2025-8145 | |
| High7.2 | Authenticated(Editor+) Privilege Escalation ≤2.7.0Update to 2.8.0 | CVE-2023-23990 | |
| High8.8 | Authenticated PHP Object Injection <2.3.4Update to 2.3.4 | CVE-2021-24280 | |
| High7.5 | Unauthenticated Arbitrary Nonce Generation <2.3.4Update to 2.3.4 | CVE-2021-24278 |
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
2.2.7 – 3.2.11Update to 3.2.12
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.2.8Update to 3.2.9
- High8.1Unauthenticated Arbitrary File Copy via move_file_to_upload
≤3.2.7Update to 3.2.8
- High8.8Unauthenticated Arbitrary File Deletion
≤3.2.4Update to 3.2.5
- High7.5Unauthenticated PHP Object Injection via PHAR Deserialization
≤3.2.4Update to 3.2.5
- High8.8Unauthenticated PHP Object Injection
≤3.2.4Update to 3.2.5
- High7.2Authenticated(Editor+) Privilege Escalation
≤2.7.0Update to 2.8.0
- High8.8Authenticated PHP Object Injection
<2.3.4Update to 2.3.4
- High7.5Unauthenticated Arbitrary Nonce Generation
<2.3.4Update to 2.3.4
Redirection for Contact Form 7: common questions
Does Redirection for Contact Form 7 have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Redirection for Contact Form 7: 9 high, 12 medium. At least one is not fixed in the latest version.
How do I check which version of Redirection for Contact Form 7 I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Redirection for Contact Form 7 vulnerability?
CVE-2026-121873, published Nov 11, 2026: Redirection for Contact Form 7 < 3.2.16 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Redirection for Contact Form 7 vulnerability listed in CISA KEV?
No. None of the known Redirection for Contact Form 7 vulnerabilities is currently listed in the CISA KEV catalog.