Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend

Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 4 issues recorded for Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-15000

Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values

Read the full analysis

Vulnerability Records

4 records
Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend banner
Latestv26.10.22.23

Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend

Renzo Johnson

Author

Renzo Johnson

4.3(190)
86/100
Last Updated
2026-10-23 (5d ago)
Active Installs
40,000+
Downloads
10,341,375
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2015-01-21 (12y ago)

Turn every form submission into a new subscriber. Contact Form 7 Extension connects your forms to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor and Moosend. Choose an email platform for each form, connect your account, and pick a list. Your next newsletter signup can go to Mailchimp while a separate lead form builds your audience in Klaviyo, all from the Contact Form 7 editor you already use. Make every signup count Grow the list you choose. Send each form to one audience, list, group or campaign. Every form has its own connection and destination. Get the details that matter. Send the email address plus any three fields you choose, such as a name, phone number or birthday. Welcome confirmed subscribers. Use double opt-in on all eight platforms, following your platform’s confirmation settings. Respect your visitors’ choice. Add a consent checkbox so only people who opt in join your list. Get started in a click. If Contact Form 7 is missing, install it straight from the setup notice. The plugin also helps you activate or update it when needed. Already using Mailchimp? Your saved audience, field choices and opt-in settings stay with your forms when you update. Find your email platform’s setup guide or visit the Help Center. Ready to do more with each signup? ChimpMatic Pro sends each signup to several lists, routes people by their answers, adds tags automatically on all eight platforms, and brings along every field your platform supports. Explore ChimpMatic Pro. External services Contact Form 7 Extension sends signup data to your selected email platform and connects to our services for account connections and updates. See the external services and what is shared.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C