Cf7 Salesforce Vulnerabilities

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known...

CVSS:

8.1

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Jun 4, 2026

CVE-2026-49109 on NVD →

[en] Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Fo...

Affected:

up to 1.4.6

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67468 on NVD →

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.4.6. This makes it possible for authenticated attackers, with Subscriber-level...

CVSS:

4.3

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

Dec 8, 2025

CVE-2025-67468 on NVD →

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used...

CVSS:

5.3

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

May 29, 2025

CVE-2025-4659 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.

Affected:

up to 1.4.0

Fixed in:

1.4.0

Disclosed:

May 17, 2024

CVE-2024-34755 on NVD →

The Integration for Contact Form 7 and Salesforce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, <=1.3.9. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to change the plugin's se...

CVSS:

4.3

Affected:

up to 1.3.9

Fixed in:

1.4.0

Disclosed:

May 14, 2024

CVE-2024-34755 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

Dec 19, 2023

CVE-2023-37982 on NVD →

The Integration for Contact Form 7 and Salesforce plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.3.3. This is due to insufficient validation on a user-supplied parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if the...

CVSS:

7.1

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Jul 13, 2023

CVE-2023-37982 on NVD →

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

CVSS:

6.1

Affected:

up to 1.2.5

Fixed in:

1.2.6

Disclosed:

Aug 26, 2021

Multiple CRM Perks plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'vx_debug' parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...

Affected:

up to 1.2.6

Fixed in:

1.2.6

Disclosed:

Aug 26, 2021

Numerous plugins from the CRM Perks vendor do not escape parameters before outputting them back in attributes in admin pages, leading to a Reflected Cross-Site Scripting issues executed in the context of a logged in administrator. It first started with an obvious XSS via the vx_debug GET parameter in 7 plugins, and...

Affected:

up to 1.2.6

Fixed in:

1.2.6

Affected:

up to 1.4.5

Fixed in:

1.4.5

CVE-2025-4659 on NVD →