Contact Form 7 – Repeatable Fields

Contact Form 7 – Repeatable Fields has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Contact Form 7 – Repeatable Fields has a vendor fix available, so running the current release closes it.

All of these findings were reported by Peter Thaleikis. Contact Form 7 – Repeatable Fields is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Contact Form 7 – Repeatable Fields vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-10180

Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode

Read the full analysis

Vulnerability Records

1 records
Contact Form 7 – Repeatable Fields banner
Latestv2.0.2

Contact Form 7 – Repeatable Fields

Felipe Elia

Author

Felipe Elia

4.3(21)
86/100
Last Updated
2024-10-22 (2y ago)
Active Installs
6,000+
Downloads
56,630
Requires WP
6.0+
Requires PHP
7.2+
Tested up to
WP 6.6.7
Created
2018-03-19 (9y ago)
Requires Plugins
contact-form-7

This plugin adds repeatable groups of fields to Contact Form 7. NOTE: Tested with Contact Form 7 5.7.7. Usage Form tab Wrap the desired fields with [field_group your_group_id_here][/field_group]. The shortcode accepts additional parameters, in WP shortcode format and in CF7 fields parameters format as well. Example: [field_group emails id="emails-groups" tabindex:1] <label>Your Email (required)[email* your-email]</label> [radio your-radio use_label_element default:1 "radio 1" "radio 2" "radio 3"] [select* your-menu include_blank "option1" "option 2"] [checkbox* your-checkbox "check 1" "check 2"] [/field_group] Mail tab In the mail settings, wrap the fields with your group id. You can use the [group_index] tag to print the group index and an additional __<NUMBER> to print a field at a specific index. Example: The second email entered by the user was: [your-email__2] These were the groups: [emails] GROUP #[group_index] Checkbox: [your-checkbox] E-mail: [your-email] Radio: [your-radio] Select: [your-menu] [/emails] Check out the Wiki Hooks available – How to customize the add and remove buttons Frequently Asked Questions Contribute You can contribute with code, issues and ideas at the GitHub repository. If you like the plugin, a review is appreciated 🙂

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C