High · 7.5 CVE-2021-36913 EUVD-2021-23489GHSA-7fvf-jrqc-p27w

Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability

Published Oct 11, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Qube One Product: Redirection for Contact Form 7 (WordPress plugin) Category: Web / CMS

Description

Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.

Affected products

Vendor	Product	Affected	Fixed
Qube One	Redirection for Contact Form 7 (WordPress plugin)	<= 2.4.0 – ≤ 2.4.0	—

References

https://patchstack.com/database/vulnerability/wpcf7-redirect/wordpress-redirection-for-contact-form-7-plugin-2-4-0-unauthenticated-options-change-vulnerability?_s_id=cve
https://wordpress.org/plugins/wpcf7-redirect/#developers