Ajax Contact Form
Ajax Contact Form has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Ajax Contact Form has a vendor fix available, so running the current release closes it.
All of these findings were reported by I8BL. Ajax Contact Form is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-22761Ajax Contact Form <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Ajax Contact Form
Author
Olaf Lederer
This free contact form plugin is used to create accessible contact forms with advanced spam protection (honeypot, cookie and optionally Cloudflare Turnstile or hCaptcha). In contrary to most other form plugins, there is no form-builder included. Features The generated form is accessible and works even when the visitor has disabled Javascript Accessible form field validation Protect your forms against spam bots using a honeypot and cookies Track successfully submitted forms in Google Analytics and/or Clicky Create multiple contact forms via an easy to use interface and add the form via the block editor or using a shortcode Collect form submissions for all your forms or the forms you choose Get insights which spam protection feature works the best for your form. A simple log file keeps track about the different spam attempts Multiple responder emails, send a HTML formatted mail in response to the form submission Works with the default wp_mail() function (use it together with the Maileroo plugin to send emails via SMTP) Optional: Protect your forms by blocking specific countries which are not relevant for your website or business Optional: Protect your contact form with the plugin WP Armour – Honeypot Anti Spam Optional: Email address verification with the verification API from Maileroo Optional: Form fields for Company name, phone number, website and an accept terms checkbox Optional: Redirect the visitor after a succesful form submission to a “Thank you” page Optional: Use the plugin’s CSS style-sheet for your forms Optional: Protect your forms with Cloudflare Turnstile or hCaptcha Optional: For additional spam protection, you can add a simple and accessible challenge to your form. The plugin is built to keep stuff simple. If you need a complex web form or if you need a form builder, please use one of the form plugins you can find in the WordPress repository. To use the “Block countries” feature we use the IP to Country API from Country.is. They offer a free service and you don’t need an API key.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C