HomeWordPress vulnerabilitiesDatabase for Contact Form 7, WPforms, Elementor forms
Database for Contact Form 7, WPforms, Elementor forms vulnerabilities
Database for Contact Form 7, WPforms, Elementor forms has 14 known vulnerabilities in this database. The most recent published record is dated 4 Aug 2026.
- Known vulnerabilities
- 14
- Active installs
- 60,000+
- Latest version
- 1.5.5
- Last updated
- 6 Sep 2026
- Most recent
- 4 Aug 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| SQL injection CVE-2026-14872 | Medium 6.8 | Before 1.5.5 | Fixed in 1.5.5 | 4 Aug 2026 |
| Cross-site scripting (XSS) CVE-2026-14870 | High 7.1 | Before 1.5.3 | Fixed in 1.5.3 | 28 Jul 2026 |
| PHP object injection CVE-2026-12081 | Medium 5.0 | Before 1.5.2 | Fixed in 1.5.2 | 13 Jul 2026 |
| Path traversal CVE-2026-9145 | Medium 6.5 | Up to 1.5.1 | Fixed in a later version (latest 1.5.5) | 2 Jul 2026 |
| Remote code execution CVE-2026-9843 | High 8.1 | Up to 1.5.1 | Fixed in a later version (latest 1.5.5) | 20 Jun 2026 |
| Broken access control CVE-2026-3831 | Medium 4.3 | Up to 1.4.9 | Fixed in a later version (latest 1.5.5) | 1 Apr 2026 |
| PHP object injection CVE-2026-2599 | Critical 9.8 | Up to 1.4.7 | Fixed in a later version (latest 1.5.5) | 5 Mar 2026 |
| Broken access control CVE-2026-0825 | Medium 5.3 | Up to 1.4.5 | Fixed in a later version (latest 1.5.5) | 28 Jan 2026 |
| Remote code execution CVE-2025-7384 | Critical 9.8 | Up to 1.4.3 | Fixed in a later version (latest 1.5.5) | 13 Aug 2025 |
| Cross-site scripting (XSS) CVE-2024-3715 | High 7.2 | Up to 1.3.8 | Fixed in a later version (latest 1.5.5) | 2 May 2024 |
| Cross-site scripting (XSS) CVE-2024-2030 | Medium 6.4 | Up to 1.3.3 | Fixed in a later version (latest 1.5.5) | 13 Mar 2024 |
| Remote code execution CVE-2024-1069 | High 7.2 | Before 1.3.3 | Fixed in 1.3.3 | 31 Jan 2024 |
| Cross-site scripting (XSS) CVE-2021-25079 | Medium 6.1 | Before 1.2.4 | Fixed in 1.2.4 | 24 Jan 2022 |
| Cross-site scripting (XSS) CVE-2021-25080 | Medium 6.1 | Before 1.1.7 | Fixed in 1.1.7 | 24 Jan 2022 |
Read the published descriptions
- CVE-2026-14872, 4 Aug 2026
- The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles. CVE record
- CVE-2026-14870, 28 Jul 2026
- The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVE record
- CVE-2026-12081, 13 Jul 2026
- The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed. CVE record
- CVE-2026-9145, 2 Jul 2026
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file - when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries' handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site's server. The file is copied to a directory unknown to the attacker; the hashed directory name provides defense-in-depth but is generated from non-cryptographic sources (uniqid() + rand()) and should not be relied upon as the primary mitigation. CVE record
- CVE-2026-9843, 20 Jun 2026
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file. CVE record
- CVE-2026-3831, 1 Apr 2026
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers. CVE record
- CVE-2026-2599, 5 Mar 2026
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. CVE record
- CVE-2026-0825, 28 Jan 2026
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions. CVE record
- CVE-2025-7384, 13 Aug 2025
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted. CVE record
- CVE-2024-3715, 2 May 2024
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-2030, 13 Mar 2024
- The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-1069, 31 Jan 2024
- The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE record
- CVE-2021-25079, 24 Jan 2022
- The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page CVE record
- CVE-2021-25080, 24 Jan 2022
- The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry CVE record
What to do if you run Database for Contact Form 7, WPforms, Elementor forms
If you run Database for Contact Form 7, WPforms, Elementor forms, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Database for Contact Form 7, WPforms, Elementor forms vulnerabilities
Free. We email you when a new vulnerability is published for Database for Contact Form 7, WPforms, Elementor forms, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.