Contact Manager
Contact Manager has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Deserialization Of Untrusted Data, Unrestricted Upload Of File With Dangerous Type.
3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
4 independent researchers contributed these findings, one record each. Contact Manager is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-68853Contact Manager <= 9.1 - Unauthenticated PHP Object Injection
Read the full analysisVulnerability Records
Contact Manager
Author
Kleor
Contact Manager allows you to easily insert contact forms (with or without CAPTCHA) into posts, pages and widgets of your website. You can create an unlimited number of contact forms and customize them completely. If you wish, Contact Manager can also record the messages in your database, and allows you to automatically offer a gift to people who send you a message. Demo interface Documentation Here’s a sample form that you can add to your website with Contact Manager. See another sample. Quick Start Here’s how to set up a form in less than 20 seconds: Insert the [contact-form id=1] code into your posts/pages/widgets to display this form. That’s all! The “Back Office” page of Contact Manager allows you to customize your interface. With this page, you will can display the items that are useful for you and remove the others. In short, you will get an interface that fits precisely to your needs. We advise you to quickly browse through the admin pages of Contact Manager in order to have a global vision, and then take the time to properly configure your options. Maximum performances for a better SEO Some WordPress plugins slow down the websites that use them. Contact Manager has been developed with a lot of attention to its performances so that it doesn’t slow down your website and it remains fast. Moreover, contrary to a common practice among WordPress plugins/themes, Contact Manager doesn’t add any CSS or JavaScript files to the pages of your website, in order to not increase their weights or the number of HTTP requests. So even after installing this plugin, your website’s pages will still load as quickly as before, and their Google PageSpeed scores will not drop. Plugins from the same author Commerce Manager, to sell your products Affiliation Manager, to create your affiliate program Membership Manager, to create your members areas Optin Manager, to build your prospects lists Easy Timer, to display count down/up timers Content Switcher, to display random or variable contents Device Detect, to detect smartphones and tablets
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C