CF7 Spreadsheets
CF7 Spreadsheets has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Missing Authorization.
None of the 3 issues recorded for CF7 Spreadsheets have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
3 independent researchers contributed these findings, one record each. CF7 Spreadsheets is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.6.19.
CVE-2025-50040CF7 Spreadsheets <= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

CF7 Spreadsheets
Author
moshensky
WordPress plugin that merge Contact form 7 functional with google spreadsheets (also works with private spreadsheet). How to use: Video instruction: https://www.youtube.com/watch?v=ZgZRBByY4fc Video instruction (OLD versions): https://www.youtube.com/watch?v=5ICWr5MMo7E Prepare API Go to the Console Developers API Create new project (or choose existing one) Click “enable API and services”, or click on “library” tab Find in list “Google sheets API” and click “Enable” Go to Credentials tab and click create credentials. In dropdown list choose Service account key. In next window select you service account, and Key type to JSON. Save the JSON document Upload JSON document on plugin page (second tab). Create a table Go to the Google Spreadsheets and create new table (or open exists table) Copy table URL and ID. For example: //docs.google.com/spreadsheets/d/1yhzO1Q6ikYysfg8LCHqegPM/edit#gid=0 in this table URL is: 1yhzO1Q6ikYysfg8LCHqegPM, and ID is: 0(parameter gid). If you have private spreadsheet – you should grant edit rights to your service account (that we create earlier) directly in spreadsheet. You could find service account email in your website admin panel after uploading JSON file. Paste the spreadsheet URL and ID in plugin options page, upload JSON file, and choose other options. Create usual form in Contact form 7 and use it.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C