Plugin security history

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 6 vulnerability records associated with Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

6Total records

0Critical

1High

5Medium

0Low

0Informational

6Patched records

0Currently marked unpatched

2021-08-26First disclosure

2026-06-04Latest disclosure

5 of 6CVE coverage

Use this history

Check and watch Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2023	1	1 records
2024	1	1 records
2025	1	1 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	1	16.7%
Medium	5	83.3%

Vulnerability-Type Breakdown

Other

2 records33.3%

First: 2023. Latest: 2026.

Cross-Site Scripting

1 record16.7%

First: 2021. Latest: 2021.

CSRF

1 record16.7%

First: 2024. Latest: 2024.

SQL Injection

1 record16.7%

First: 2025. Latest: 2025.

Information Disclosure

1 record16.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 6
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.3.8
1.4.4
1.4.3
1.3.2
1.2.9
1.2.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.3.7`	Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection	June 4, 2026	1.3.8	High
`*-1.4.3`	Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure	January 22, 2026	1.4.4	Medium
`*-1.4.2`	Integration for Contact Form 7 HubSpot <= 1.4.2 - Authenticated (Administrator+) SQL Injection	December 25, 2025	1.4.3	Medium
`*-1.3.1`	Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery	May 14, 2024	1.3.2	Medium
`*-1.2.8`	Integration for Contact Form 7 HubSpot <= 1.2.8 - Open Redirect via state parameter	April 26, 2023	1.2.9	Medium
`*-1.1.9`	CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting	August 26, 2021	1.2.0	Medium

Selected source records

Latest Records

HighCVE-2026-49763

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection

Published: June 4, 2026

Affected versions: *-1.3.7
Patched versions: 1.3.8

Original Wordfence record

MediumCVE-2026-24559

Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure

Published: January 22, 2026

Affected versions: *-1.4.3
Patched versions: 1.4.4

Original Wordfence record

MediumCVE-2025-68590

Integration for Contact Form 7 HubSpot <= 1.4.2 - Authenticated (Administrator+) SQL Injection

Published: December 25, 2025

Affected versions: *-1.4.2
Patched versions: 1.4.3

Original Wordfence record

MediumCVE-2024-34756

Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery

Published: May 14, 2024

Affected versions: *-1.3.1
Patched versions: 1.3.2

Original Wordfence record

MediumCVE-2023-31095

Integration for Contact Form 7 HubSpot <= 1.2.8 - Open Redirect via state parameter

Published: April 26, 2023

Affected versions: *-1.2.8
Patched versions: 1.2.9

Original Wordfence record

Medium

CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting

Published: August 26, 2021

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.5
Patched versions: 1.0.6

Affected versions: *-1.2.1
Patched versions: 1.2.2

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.3
Patched versions: 1.1.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.3
Patched versions: 1.0.4

Affected versions: *-1.0.4
Patched versions: 1.0.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.4
Patched versions: 1.1.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.2.8
Patched versions: 1.2.9

Affected versions: *-1.5.8
Patched versions: 1.5.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.3
Patched versions: 1.2.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.9
Patched versions: 1.1.0

Affected versions: *-1.1.9
Patched versions: 1.2.0

Original Wordfence record

Highest-Severity Records

HighCVE-2026-49763

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection

Published: June 4, 2026

Affected versions: *-1.3.7
Patched versions: 1.3.8

Original Wordfence record

Medium

CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting

Published: August 26, 2021

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.5
Patched versions: 1.0.6

Affected versions: *-1.2.1
Patched versions: 1.2.2

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.3
Patched versions: 1.1.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.3
Patched versions: 1.0.4

Affected versions: *-1.0.4
Patched versions: 1.0.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.4
Patched versions: 1.1.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.2.8
Patched versions: 1.2.9

Affected versions: *-1.5.8
Patched versions: 1.5.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.3
Patched versions: 1.2.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.9
Patched versions: 1.1.0

Affected versions: *-1.1.9
Patched versions: 1.2.0

Original Wordfence record

MediumCVE-2025-68590

Integration for Contact Form 7 HubSpot <= 1.4.2 - Authenticated (Administrator+) SQL Injection

Published: December 25, 2025

Affected versions: *-1.4.2
Patched versions: 1.4.3

Original Wordfence record

MediumCVE-2024-34756

Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery

Published: May 14, 2024

Affected versions: *-1.3.1
Patched versions: 1.3.2

Original Wordfence record

MediumCVE-2023-31095

Integration for Contact Form 7 HubSpot <= 1.2.8 - Open Redirect via state parameter

Published: April 26, 2023

Affected versions: *-1.2.8
Patched versions: 1.2.9

Original Wordfence record

MediumCVE-2026-24559

Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure

Published: January 22, 2026

Affected versions: *-1.4.3
Patched versions: 1.4.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory