Post Fields for Contact Form 7

Post Fields for Contact Form 7 has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 1 of the records (100%).

The one issue recorded for Post Fields for Contact Form 7 has a vendor fix available, so running the current release closes it.

All of these findings were reported by cazy. Post Fields for Contact Form 7 is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Post Fields for Contact Form 7 vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-121768

Post Fields for Contact Form 7 <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Post Fields for Contact Form 7 banner
Latestv2.7.1

Post Fields for Contact Form 7

Markus Wiesenhofer

Author

Markus Wiesenhofer

5.0(34)
100/100
Last Updated
2026-10-30 (12d ago)
Active Installs
3,000+
Downloads
55,816
Requires WP
4.4+
Requires PHP
7.0+
Tested up to
WP 7.1.4
Created
2016-11-11 (10y ago)
Requires Plugins
contact-form-7

Contact Form 7 is a fantastic plugin for form. The post-fields extension enables you to create image drop-down-menues, checkboxes and radio-buttons based on posts or other kinds of content (custom post types). Features of post fields beautiful drop-down-menues, checkboxes and radio buttons with post image, excerpt and meta data selection of the post type (posts, pages, attachments, custom post types) selection and limitation of categories (taxonomies) customized/individual formatting of the label configuring the value attribute pretty post hyperlinks in the message body customized sorting of the post type Display a search box on drop-down-menues limitation of the post type based on its particular status (published, draft etc.) The default value of the field can easily be selected by using $_GET or $_POST variables (see FAQ). Required Plugin Contact Form 7 by Takayuki Miyoshi – Contact Form 7 can manage multiple contact forms, plus you can customize the form and the mail contents flexibly with simple markup.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C