CF7 Spreadsheets

CF7 Spreadsheets has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Missing Authorization.

None of the 3 issues recorded for CF7 Spreadsheets have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each. CF7 Spreadsheets is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.6.19.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage0%
Open

3

Fixed

0

Get automatic notifications for all CF7 Spreadsheets vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-50040

CF7 Spreadsheets <= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
CF7 Spreadsheets banner
Latestv2.3.2

CF7 Spreadsheets

moshensky

Author

moshensky

4.7(19)
94/100
Last Updated
2020-12-29 (6y ago)
Active Installs
300+
Downloads
12,185
Requires WP
4.7+
Requires PHP
0+
Tested up to
WP 5.6.19
Created
2017-01-05 (10y ago)

WordPress plugin that merge Contact form 7 functional with google spreadsheets (also works with private spreadsheet). How to use: Video instruction: https://www.youtube.com/watch?v=ZgZRBByY4fc Video instruction (OLD versions): https://www.youtube.com/watch?v=5ICWr5MMo7E Prepare API Go to the Console Developers API Create new project (or choose existing one) Click “enable API and services”, or click on “library” tab Find in list “Google sheets API” and click “Enable” Go to Credentials tab and click create credentials. In dropdown list choose Service account key. In next window select you service account, and Key type to JSON. Save the JSON document Upload JSON document on plugin page (second tab). Create a table Go to the Google Spreadsheets and create new table (or open exists table) Copy table URL and ID. For example: //docs.google.com/spreadsheets/d/1yhzO1Q6ikYysfg8LCHqegPM/edit#gid=0 in this table URL is: 1yhzO1Q6ikYysfg8LCHqegPM, and ID is: 0(parameter gid). If you have private spreadsheet – you should grant edit rights to your service account (that we create earlier) directly in spreadsheet. You could find service account email in your website admin panel after uploading JSON file. Paste the spreadsheet URL and ID in plugin options page, upload JSON file, and choose other options. Create usual form in Contact form 7 and use it.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C