Cf7 Constant Contact Vulnerabilities

The Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP ch...

CVSS:

8.1

Affected:

up to 1.1.6

Fixed in:

1.1.7

Disclosed:

Jun 4, 2026

CVE-2026-49106 on NVD →

The Integration for Contact Form 7 and Constant Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVSS:

4.4

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Jul 30, 2025

CVE-2025-54684 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.

Affected:

up to 1.1.6

Fixed in:

1.1.6

Disclosed:

Jun 3, 2024

CVE-2024-35632 on NVD →

The Integration for Contact Form 7 and Constant Contact plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via...

CVSS:

4.3

Affected:

up to 1.1.5

Fixed in:

1.1.6

Disclosed:

May 27, 2024

CVE-2024-35632 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.

Affected:

up to 1.1.5

Fixed in:

1.1.5

Disclosed:

Dec 7, 2023

CVE-2023-47779 on NVD →

The Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.1.4. This is due to insufficient validation a redirect url. This makes it possible for unauthenticated attackers to redirect users to poten...

CVSS:

4.7

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Nov 14, 2023

CVE-2023-47779 on NVD →

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

CVSS:

6.1

Affected:

up to 1.0.9

Fixed in:

1.1.0

Disclosed:

Aug 26, 2021

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

Affected:

up to 1.1.0

Fixed in:

1.1.0

Disclosed:

Aug 26, 2021

Numerous plugins from the CRM Perks vendor do not escape parameters before outputting them back in attributes in admin pages, leading to a Reflected Cross-Site Scripting issues executed in the context of a logged in administrator. It first started with an obvious XSS via the vx_debug GET parameter in 7 plugins, and...

Affected:

up to 1.1.0

Fixed in:

1.1.0

Affected:

up to 1.1.8

Fixed in:

1.1.8

CVE-2025-54684 on NVD →