Cf7 Conditional Fields Vulnerabilities

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 2.7.2. This makes it possible for unauthenticated attackers to starve the server of resources.

CVSS:

5.3

Affected:

up to 2.7.2

Fixed in:

2.7.3

Disclosed:

May 4, 2026

CVE-2026-25863 on NVD →

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbi...

CVSS:

4.4

Affected:

up to 2.4.15

Fixed in:

2.5

Disclosed:

Oct 24, 2024

CVE-2024-50412 on NVD →

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's setting...

CVSS:

4.3

Affected:

up to 2.4.13

Fixed in:

2.4.14

Disclosed:

Jul 19, 2024

CVE-2024-5804 on NVD →

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on an unknown function in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to make use o...

CVSS:

4.3

Affected:

up to 2.4.1

Fixed in:

2.4.2

Disclosed:

Nov 16, 2023

CVE-2023-47838 on NVD →

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when showing admin notices in all versions up to 2.4.0 (inclusive). This makes it possible for attackers to read admin notices.

CVSS:

4.3

Affected:

up to 2.4.0

Fixed in:

2.4.1

Disclosed:

Nov 14, 2023