Known vulnerabilities in themeisle Redirection for Contact Form 7

Is your version affected?

CVE	Summary	Score	Published
CVE-2026-120659	Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter	5.3 Medium	Nov 6, 2026
CVE-2026-23970	Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions	7.1 High	Jun 15, 2026
CVE-2025-14800	The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…	8.1 High	Dec 21, 2025
CVE-2025-9562	The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…	6.4 Medium	Oct 18, 2025
CVE-2025-8289	The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…	7.5 High	Aug 20, 2025
CVE-2025-8141	The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient…	8.8 High	Aug 20, 2025
CVE-2025-8145	The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…	8.8 High	Aug 20, 2025
CVE-2023-39920	Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting…	7.5 High	Dec 13, 2024
CVE-2022-4974	The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…	6.3 Medium	Oct 16, 2024