Cf7 Google Sheets Connector Vulnerabilities

The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVSS:

4.9

Affected:

up to 5.2.1

Fixed in:

5.2.2

Disclosed:

Jul 31, 2026

CVE-2026-16614 on NVD →

[en] Missing Authorization vulnerability in GSheetConnector CF7 Google Sheets Connector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Google Sheets Connector: from n/a through 5.0.17.

Affected:

up to 5.0.18

Fixed in:

5.0.18

Disclosed:

Feb 3, 2025

CVE-2025-22686 on NVD →

The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.0.17. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.0.17

Fixed in:

5.0.18

Disclosed:

Jan 31, 2025

CVE-2025-22686 on NVD →

[en] The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration setti...

Affected:

up to 5.0.10

Fixed in:

5.0.10

Disclosed:

Jun 8, 2024

CVE-2024-5654 on NVD →

The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings,...

CVSS:

6.5

Affected:

up to 5.0.9

Fixed in:

5.0.10

Disclosed:

Jun 7, 2024

CVE-2024-5654 on NVD →

[en] Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5.

Affected:

up to 5.0.6

Fixed in:

5.0.6

Disclosed:

Mar 26, 2024

CVE-2023-44989 on NVD →

The CF7 Google Sheets Connector plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.5 via the debug log functionality in google-sheet-connector.php. This makes it possible for unauthenticated attackers to extract sensitive data.

CVSS:

7.5

Affected:

up to 5.0.5

Fixed in:

5.0.6

Disclosed:

Nov 30, 2023

CVE-2023-44989 on NVD →

[en] The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 5.0.2

Fixed in:

5.0.2

Disclosed:

Jul 4, 2023

CVE-2023-2320 on NVD →

The CF7 Google Sheets Connector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘code’ parameter in versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 5.0.1

Fixed in:

5.0.2

Disclosed:

Jun 12, 2023

CVE-2023-2320 on NVD →