Contact Form 7 – Repeatable Fields
Contact Form 7 – Repeatable Fields has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Contact Form 7 – Repeatable Fields has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Contact Form 7 – Repeatable Fields is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.
CVE-2024-10180Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode
Read the full analysisVulnerability Records

Contact Form 7 – Repeatable Fields
Author
Felipe Elia
contact-form-7This plugin adds repeatable groups of fields to Contact Form 7. NOTE: Tested with Contact Form 7 5.7.7. Usage Form tab Wrap the desired fields with [field_group your_group_id_here][/field_group]. The shortcode accepts additional parameters, in WP shortcode format and in CF7 fields parameters format as well. Example: [field_group emails id="emails-groups" tabindex:1] <label>Your Email (required)[email* your-email]</label> [radio your-radio use_label_element default:1 "radio 1" "radio 2" "radio 3"] [select* your-menu include_blank "option1" "option 2"] [checkbox* your-checkbox "check 1" "check 2"] [/field_group] Mail tab In the mail settings, wrap the fields with your group id. You can use the [group_index] tag to print the group index and an additional __<NUMBER> to print a field at a specific index. Example: The second email entered by the user was: [your-email__2] These were the groups: [emails] GROUP #[group_index] Checkbox: [your-checkbox] E-mail: [your-email] Radio: [your-radio] Select: [your-menu] [/emails] Check out the Wiki Hooks available – How to customize the add and remove buttons Frequently Asked Questions Contribute You can contribute with code, issues and ideas at the GitHub repository. If you like the plugin, a review is appreciated 🙂
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C