Cf7 Hubspot Vulnerabilities

The Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.3.7 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is pr...

CVSS:

8.1

Affected:

up to 1.3.7

Fixed in:

1.3.8

Disclosed:

Jun 4, 2026

CVE-2026-49763 on NVD →

[en] Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensitive Data.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.3.

Affected:

up to 1.4.3

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24559 on NVD →

The Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or confi...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Jan 22, 2026

CVE-2026-24559 on NVD →

The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admini...

CVSS:

4.9

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Dec 25, 2025

CVE-2025-68590 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.

Affected:

up to 1.4.2

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68590 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 HubSpot.This issue affects Integration for Contact Form 7 HubSpot: from n/a through 1.3.1.

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

May 17, 2024

CVE-2024-34756 on NVD →

The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to change the plugin's settings vi...

CVSS:

4.3

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

May 14, 2024

CVE-2024-34756 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.

Affected:

up to 1.2.9

Fixed in:

1.2.9

Disclosed:

Dec 29, 2023

CVE-2023-31095 on NVD →

Integration for Contact Form 7 HubSpot is vulnerable to Open Redirects in versions up to, and including, 1.2.8. This is due to insufficient validation on the redirect url supplied via the 'state' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can...

CVSS:

4.3

Affected:

up to 1.2.8

Fixed in:

1.2.9

Disclosed:

Apr 26, 2023

CVE-2023-31095 on NVD →

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

CVSS:

6.1

Affected:

up to 1.1.9

Fixed in:

1.2.0

Disclosed:

Aug 26, 2021

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Aug 26, 2021

Numerous plugins from the CRM Perks vendor do not escape parameters before outputting them back in attributes in admin pages, leading to a Reflected Cross-Site Scripting issues executed in the context of a logged in administrator. It first started with an obvious XSS via the vx_debug GET parameter in 7 plugins, and...

Affected:

up to 1.2.0

Fixed in:

1.2.0