Message Filter for Contact Form 7

Message Filter for Contact Form 7 has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (56%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 9 issues recorded for Message Filter for Contact Form 7 has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (2) reported by dutafi. Message Filter for Contact Form 7 is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

9

Get automatic notifications for all Message Filter for Contact Form 7 vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-65438

Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

9 records
2026-07-27 00:00CVE-2026-65438
7.2
High
dutafiYes
2026-07-08 00:00CVE-2026-57423
6.1
Medium
dutafiYes
2026-04-30 17:17CVE-2024-13362
6.1
Medium
Asaf MozesYes
2025-04-22 00:00CVE-2025-46252
4.9
Medium
Phat RiOYes
2024-12-06 12:01CVE-2024-12026
4.3
Medium
Tieu Pham Trong NhanYes
2024-12-05 19:52CVE-2024-12027
4.3
Medium
Tieu Pham Trong NhanYes
2024-12-05 00:00CVE-2024-54254
4.3
Medium
Abdi PranataYes
2024-08-01 00:00CVE-2024-39647
6.1
Medium
Dimas MaulanaYes
2023-07-18 00:00CVE-2023-33999
6.1
Medium
Rafie MuhammadYes
Showing 1–9 of 9 reports
Plugin Profile
Latestv1.6.4.1

Message Filter for Contact Form 7

Kofi Mokome

Author

Kofi Mokome

4.9(13)
98/100
Last Updated
2026-09-11 (2d ago)
Active Installs
1,000+
Downloads
53,086
Requires WP
6.6+
Requires PHP
8.0+
Tested up to
WP 7.1
Created
2018-08-30 (8y ago)

Do you receive spams every day? have you installed a dozen plugins and you still get spammed? Well this may be the solution to your problem. This plugin filters messages submitted from contact form 7. You can decide to either filter messages based on restricted words found in the content of the message or filter based on the email of the person submitting the form. Filters will be extended to other contact form plugins with time. Supported Plugins Contact form 7 WPForms Note: This is just an extension. This plugin is not affiliated with or endorsed by Contact Form 7 or WPForms. Pro Features Upgrade to the pro version from the Account submenu page to have access the following features: 1. Unlimited words and emails: Add as many words and emails as you want 2. Month Reports: Receive monthly spam reports directly to your email 3. Spam Suggestion: Receive suggestions for new spam words and emails 4. Blacklist/Whitelist forms: Decide which forms to validate or not to validate 5. CSV Upload: Upload CSV with spam words/emails 6. Add custom filters: Create your own custom filters PRIVACY We may collect ONLY the following information, if accepted by the site administrator: – The messages blocked by the plugin and – Words added to the plugin as spam This is used solely for the purpose of making improvements to the plugin. In addition to the above, Freemius, a third party plugin used to manage plugin licences may also collect additional information, if the site administrator accepts. How to Contribute The source codes can be downloaded here GitHub

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C