Pay with Contact Form 7

Pay with Contact Form 7 has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; none of them are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

None of the 4 issues recorded for Pay with Contact Form 7 have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, one record each. Pay with Contact Form 7 is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.1.12.

Strategic Overview

Avg CVSSMedium

5.2/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all Pay with Contact Form 7 vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2025-52777

Pay with Contact Form 7 <= 1.0.4 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records


2026-08-19 00:00	Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure Pay with Contact Form 7 <= 1.0.4	`CVE-2026-73384`	5.3 Medium	Nabil Irawan	No
2025-07-07 00:00	Pay with Contact Form 7 <= 1.0.4 - Reflected Cross-Site Scripting Pay with Contact Form 7 <= 1.0.4	`CVE-2025-52777`	6.1 Medium	Nguyen Xuan Chien	No
2025-06-05 00:00	Pay with Contact Form 7 <= 1.0.4 - Cross-Site Request Forgery Pay with Contact Form 7 <= 1.0.4	`CVE-2025-24772`	4.3 Medium	haudayroi	No
2025-04-04 00:00	Pay with Contact Form 7 <= 1.0.4 - Authenticated (Administrator+) SQL Injection Pay with Contact Form 7 <= 1.0.4	`CVE-2025-32126`	4.9 Medium	João Pedro Soares de Alcântara	No

Showing 1–4 of 4 reports

Latestv1.0.4

Pay with Contact Form 7

Author

cmsMinds

4.0(2)

80/100

Last Updated

2023-03-24 (4y ago)

Active Installs

90+

Downloads

7,916

Requires WP

4.7+

Requires PHP

Tested up to

WP 6.1.12

Created

2017-07-11 (9y ago)

Each contact form can have its own PayPal settings. When a contact form is integrated with PayPal, and the user submits the form it will send an email also & it will auto redirect to PayPal. If you have any problems, questions, or issues about this PayPal plugins then please create a support request and we will get back to you as quickly as possible. The administrator can see all the forms data listing with PayPal transaction details. Note: This PayPal plugin works with both the old and new Contact Form 7 interface. A PayPal account is required to use this plugin. Contact Form 7 – PayPal Integration Add-on Features Set item's name, price, SKU/ID per contact form Built in support for 18 languages (PayPal currently supports 18 languages) Built in support 25 currencies (PayPal currently supports 25 currencies) PayPal testing through SandBox Choose a cancel payment URL Choose a successful payment URL

View on WordPress.org