--- title: "Themeisle Redirection for Contact Form 7 vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7 type: product description: "Themeisle Redirection for Contact Form 7 has 9 published CVEs, 0 in CISA KEV and 1 with public exploits." updated: 2026-11-06 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Themeisle Redirection for Contact Form 7 vulnerabilities Vendor: [Themeisle](https://radicalnotion.ai/vendor/themeisle) - **Published CVEs:** 9 - **In CISA KEV:** 0 - **With a public exploit:** 1 - **With a patch:** 9 - **Average CVSS:** 7.3 - **First CVE:** 2024-10-16 - **Latest CVE:** 2026-11-06 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 6 | | Medium | 3 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 3 | | [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 2 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 2 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 2 | | 2025 | 5 | | 2026 | 2 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 3.2.4 | range | 3 | | \< 2.5.0 | range | 1 | | \<= 2.9.2 | range | 1 | | \<= 3.2.14 | range | 1 | | \<= 3.2.6 | range | 1 | | \<= 3.2.7 | range | 1 | | \<= 3.2.8 | range | 1 | | \>= 3.0.0 | range | 1 | | \>= 3.2.9 | range | 1 | | 2.5.0 | patched | 1 | | 3.0.0 | patched | 1 | | 3.2.9 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-120659 | Redirection for Contact Form 7 \<= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter | medium | 5.3 | No | No | Yes | | CVE-2026-23970 | WordPress Redirection for Contact Form 7 plugin \<= 3.2.8 - Cross Site Scripting (XSS) vulnerability | high | 7.1 | No | No | Yes | | CVE-2025-14800 | Redirection for Contact Form 7 \<= 3.2.7 - Unauthenticated Arbitrary File Copy via move\_file\_to\_upload | high | 8.1 | No | No | Yes | | CVE-2025-9562 | Redirection for Contact Form 7 \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs\_date Shortcode | medium | 6.4 | No | No | Yes | | CVE-2025-8141 | Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated Arbitrary File Deletion | high | 8.8 | No | No | Yes | | CVE-2025-8289 | Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization | high | 7.5 | No | No | Yes | | CVE-2025-8145 | Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection | high | 8.8 | No | No | Yes | | CVE-2023-39920 | WordPress Redirection for Contact Form 7 plugin \<= 2.9.2 - Broken Access Control vulnerability | high | 7.5 | No | Yes | Yes | | CVE-2022-4974 | Freemius SDK \<= 2.4.2 - Missing Authorization Checks | medium | 6.3 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Themeisle Redirection for Contact Form 7 have? Themeisle Redirection for Contact Form 7 has 9 published CVE records since 2024. ### How many Themeisle Redirection for Contact Form 7 CVEs are in CISA KEV? None of Themeisle Redirection for Contact Form 7's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Themeisle Redirection for Contact Form 7 vulnerabilities? Yes — 1 of Themeisle Redirection for Contact Form 7's CVEs have a known public exploit. ### Which versions of Themeisle Redirection for Contact Form 7 are affected? 12 distinct Themeisle Redirection for Contact Form 7 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Themeisle Redirection for Contact Form 7 CVEs? Themeisle Redirection for Contact Form 7's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')). ### What is the average severity of Themeisle Redirection for Contact Form 7 CVEs? The average CVSS base score across Themeisle Redirection for Contact Form 7's scored CVEs is 7.3. ## Other products from this vendor - [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy-feed-to-post-autoblogging-news-and-youtube-video-feeds-aggregator) (17 CVEs) - [orbit fox](https://radicalnotion.ai/vendor/themeisle/orbit-fox) (15 CVEs) - [Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More](https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more) (14 CVEs) - [multiple page generator](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator) (11 CVEs) - [Multiple Page Generator Plugin – MPG](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator-plugin-mpg) (11 CVEs) - [Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE](https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse) (11 CVEs) - [otter blocks](https://radicalnotion.ai/vendor/themeisle/otter-blocks) (10 CVEs) - [rss aggregator by feedzy](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy) (9 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.