Is Contact Form Email safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.3.71). As of 2026-11-04. 14 issues are on record for older versions; version 1.3.69 or newer fixes all of them that state a fix. Keep Contact Form Email on the latest version (1.3.71) and remove it if you do not use it.

Which versions of Contact Form Email are vulnerable?

Known issues on record (newest first): Stored cross-site scripting (XSS) (1.3.68 and older, fixed in 1.3.69); Missing authorization check (1.3.63 and older, fixed in 1.3.64); Missing authorization check (1.3.60 and older, fixed in 1.3.61); Missing authorization check (1.3.58 and older, fixed in 1.3.59); Stored cross-site scripting (XSS) (1.3.52 and older, fixed in 1.3.53); Security issue (1.3.41 and older, fixed in 1.3.42). The full list with sources is on this page.

What is the latest version of Contact Form Email?

1.3.71, according to wordpress.org (last updated 2026-10-30). It has 8,000+ active installs.

What should I do if my Contact Form Email is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update contact-form-to-email). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · contact-form-to-email · data as of 2026-11-04

Is Contact Form Email safe? Known vulnerabilities and latest version

Latest version: 1.3.71
Last updated: 2026-10-30
Active installs: 8,000+
Known issues on record: 14
Unpatched in latest: 0
Tested up to WP: 7.1.4

Contact form with visual form builder, database storage, CSV/Excel export, and direct email replies powered by a free AI assistant. — by codepeople

What to do

Update to the latest version (1.3.71). Anything older than 1.3.69 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get contact-form-to-email --field=version shows what you run; wp plugin update contact-form-to-email updates it.

Check your version

Known vulnerabilities

14 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 7.1 CVE-2026-112379 · published 2026-10-22

Stored cross-site scripting (XSS) in Contact Form Email (1.3.68 and older)

Affected: 1.3.68 and older
Fixed in: 1.3.69
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.

NVD CVE-2026-112379 Patchstack advisory

medium 6.5 CVE-2026-32483 · published 2026-03-25

Missing authorization check in Contact Form Email (1.3.63 and older)

Affected: 1.3.63 and older
Fixed in: 1.3.64
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: advisory text · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.

NVD CVE-2026-32483 Patchstack advisory

medium 6.5 CVE-2025-10019 · published 2025-12-18

Missing authorization check in Contact Form Email (1.3.60 and older)

Affected: 1.3.60 and older
Fixed in: 1.3.61
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.

NVD CVE-2025-10019 Patchstack advisory

medium 6.5 CVE-2025-64369 · published 2025-11-13

Missing authorization check in Contact Form Email (1.3.58 and older)

Affected: 1.3.58 and older
Fixed in: 1.3.59
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-64369 Patchstack advisory

medium 4.8 CVE-2025-24727 · published 2025-01-24

Stored cross-site scripting (XSS) in Contact Form Email (1.3.52 and older)

Affected: 1.3.52 and older
Fixed in: 1.3.53
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.

NVD CVE-2025-24727 Patchstack advisory

medium 6.5 CVE-2023-48318 · published 2024-06-04

Security issue in Contact Form Email (1.3.41 and older)

Affected: 1.3.41 and older
Fixed in: 1.3.42
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.

NVD CVE-2023-48318 Patchstack advisory

medium 4.3 CVE-2023-28494 · published 2024-06-04

Missing authorization check in Contact Form Email (1.3.31 and older)

Affected: 1.3.31 and older
Fixed in: 1.3.32
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.

NVD CVE-2023-28494 Patchstack advisory

medium 5.3 CVE-2024-31302 · published 2024-04-10

Information disclosure in Contact Form Email (1.3.44 and older)

Affected: 1.3.44 and older
Fixed in: 1.3.45
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.

NVD CVE-2024-31302 Patchstack advisory

medium 4.8 CVE-2023-5955 · published 2023-12-11

Stored cross-site scripting (XSS) in Contact Form Email (older than 1.3.44)

Affected: older than 1.3.44
Fixed in: 1.3.44
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

NVD CVE-2023-5955 WPScan advisory

medium 5.4 CVE-2023-2718 · published 2023-06-12

Stored cross-site scripting (XSS) in Contact Form Email (older than 1.3.38)

Affected: older than 1.3.38
Fixed in: 1.3.38
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.

NVD CVE-2023-2718 WPScan advisory onvio.nl

medium 4.8 CVE-2021-42361 · published 2021-11-17

Stored cross-site scripting (XSS) in Contact Form Email (1.3.24 to 1.3.24)

Affected: 1.3.24 to 1.3.24
Fixed in: 1.3.25 *
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

NVD CVE-2021-42361 Code change (fix)Wordfence advisory

medium 6.1 CVE-2018-20963 · published 2019-08-13

Cross-site scripting (XSS) in Contact Form Email (older than 1.2.66)

Affected: older than 1.2.66
Fixed in: 1.2.66
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.

NVD CVE-2018-20963 wordpress.org

high 8.8 CVE-2018-20964 · published 2019-08-13

Cross-site request forgery (CSRF) in Contact Form Email (older than 1.2.66)

Affected: older than 1.2.66
Fixed in: 1.2.66
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

NVD CVE-2018-20964 wordpress.org

medium 6.1 CVE-2019-9646 · published 2019-03-10

Cross-site scripting (XSS) in Contact Form Email (older than 1.2.66)

Affected: older than 1.2.66
Fixed in: 1.2.66
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."

NVD CVE-2019-9646 wordpress.org lists.openwall.net security-consulting.icu

Recent activity

2026-10-30 — latest release on wordpress.org (1.3.71).
2026-10-22 — Stored cross-site scripting (XSS) disclosed (CVE-2026-112379), fixed in 1.3.69.
2026-03-25 — Missing authorization check disclosed (CVE-2026-32483), fixed in 1.3.64.
2025-12-18 — Missing authorization check disclosed (CVE-2025-10019), fixed in 1.3.61.

Free. We check the CVE feeds every day and email you only when a new issue for Contact Form Email (contact-form-to-email) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (7) · Missing authorization (4) · Sensitive data exposure (1) · Cross-site request forgery (CSRF) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/contact-form-to-email (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/contact-form-to-email"><img src="https://laskyr.com/plugins/contact-form-to-email/badge.svg" alt="Contact Form Email vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Contact Form Email safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (1.3.71)

What to do

Check your version

Known vulnerabilities

Stored cross-site scripting (XSS) in Contact Form Email (1.3.68 and older)

Missing authorization check in Contact Form Email (1.3.63 and older)

Missing authorization check in Contact Form Email (1.3.60 and older)

Missing authorization check in Contact Form Email (1.3.58 and older)

Stored cross-site scripting (XSS) in Contact Form Email (1.3.52 and older)

Security issue in Contact Form Email (1.3.41 and older)

Missing authorization check in Contact Form Email (1.3.31 and older)

Information disclosure in Contact Form Email (1.3.44 and older)

Stored cross-site scripting (XSS) in Contact Form Email (older than 1.3.44)

Stored cross-site scripting (XSS) in Contact Form Email (older than 1.3.38)

Stored cross-site scripting (XSS) in Contact Form Email (1.3.24 to 1.3.24)

Cross-site scripting (XSS) in Contact Form Email (older than 1.2.66)

Cross-site request forgery (CSRF) in Contact Form Email (older than 1.2.66)

Cross-site scripting (XSS) in Contact Form Email (older than 1.2.66)

Recent activity

Get an email when Contact Form Email has a new vulnerability

Browse vulnerabilities

Where this data comes from