Flamingo
Flamingo has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 6.4 out of 10.
The most common weakness is Command Injection, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Flamingo has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by jopet. Flamingo is installed on roughly 800,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
Flamingo <= 2.1 - CSV Injection
Read the full analysisVulnerability Records
Flamingo
Author
Rock Lobster Inc.
Flamingo is a message storage plugin originally created for Contact Form 7, which doesn’t store submitted messages. After activation of the plugin, you’ll find Flamingo on the WordPress admin screen menu. All messages through contact forms are listed there and are searchable. With Flamingo, you no longer need to worry about losing important messages due to mail server issues or misconfiguration in mail setup. For more detailed information, please refer to the Contact Form 7 documentation page. Privacy Notices This plugin stores submission data collected through contact forms, which may include the submitters’ personal information, in the database on the server that hosts the website.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C