Plugin security history

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 6 vulnerability records associated with Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

6Total records

0Critical

2High

4Medium

0Low

0Informational

6Patched records

0Currently marked unpatched

2021-08-26First disclosure

2026-06-04Latest disclosure

5 of 6CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2023	1	1 records
2024	1	1 records
2025	2	2 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	2	33.3%
Medium	4	66.7%

Vulnerability-Type Breakdown

Other

2 records33.3%

First: 2023. Latest: 2026.

Cross-Site Scripting

1 record16.7%

First: 2021. Latest: 2021.

CSRF

1 record16.7%

First: 2024. Latest: 2024.

Information Disclosure

1 record16.7%

First: 2025. Latest: 2025.

Missing Authorization

1 record16.7%

First: 2025. Latest: 2025.

Patch Status

Patched: 6
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.4.4
1.4.7
1.4.5
1.4.0
1.3.4
1.2.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.4.3`	Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection	June 4, 2026	1.4.4	High
`*-1.4.6`	Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization	December 8, 2025	1.4.7	Medium
`*-1.4.4`	Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure	May 29, 2025	1.4.5	Medium
`*-1.3.9`	Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery	May 14, 2024	1.4.0	Medium
`*-1.3.3`	Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect	July 13, 2023	1.3.4	High
`*-1.2.5`	CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting	August 26, 2021	1.2.6	Medium

Selected source records

Latest Records

HighCVE-2026-49109

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection

Published: June 4, 2026

Affected versions: *-1.4.3
Patched versions: 1.4.4

Original Wordfence record

MediumCVE-2025-67468

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization

Published: December 8, 2025

Affected versions: *-1.4.6
Patched versions: 1.4.7

Original Wordfence record

MediumCVE-2025-4659

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure

Published: May 29, 2025

Affected versions: *-1.4.4
Patched versions: 1.4.5

Original Wordfence record

MediumCVE-2024-34755

Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery

Published: May 14, 2024

Affected versions: *-1.3.9
Patched versions: 1.4.0

Original Wordfence record

HighCVE-2023-37982

Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect

Published: July 13, 2023

Affected versions: *-1.3.3
Patched versions: 1.3.4

Original Wordfence record

Medium

CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting

Published: August 26, 2021

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.5
Patched versions: 1.0.6

Affected versions: *-1.2.1
Patched versions: 1.2.2

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.3
Patched versions: 1.1.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.3
Patched versions: 1.0.4

Affected versions: *-1.0.4
Patched versions: 1.0.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.4
Patched versions: 1.1.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.2.8
Patched versions: 1.2.9

Affected versions: *-1.5.8
Patched versions: 1.5.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.3
Patched versions: 1.2.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.9
Patched versions: 1.1.0

Affected versions: *-1.1.9
Patched versions: 1.2.0

Original Wordfence record

Highest-Severity Records

HighCVE-2026-49109

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection

Published: June 4, 2026

Affected versions: *-1.4.3
Patched versions: 1.4.4

Original Wordfence record

HighCVE-2023-37982

Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect

Published: July 13, 2023

Affected versions: *-1.3.3
Patched versions: 1.3.4

Original Wordfence record

Medium

CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting

Published: August 26, 2021

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.5
Patched versions: 1.0.6

Affected versions: *-1.2.1
Patched versions: 1.2.2

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.3
Patched versions: 1.1.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.3
Patched versions: 1.0.4

Affected versions: *-1.0.4
Patched versions: 1.0.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.2.5
Patched versions: 1.2.6

Affected versions: *-1.0.6
Patched versions: 1.0.7

Affected versions: *-1.1.4
Patched versions: 1.1.5

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.2.8
Patched versions: 1.2.9

Affected versions: *-1.5.8
Patched versions: 1.5.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.1.0
Patched versions: 1.1.1

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.1.8
Patched versions: 1.1.9

Affected versions: *-1.0.8
Patched versions: 1.0.9

Affected versions: *-1.2.3
Patched versions: 1.2.4

Affected versions: *-1.0.7
Patched versions: 1.0.8

Affected versions: *-1.0.9
Patched versions: 1.1.0

Affected versions: *-1.1.9
Patched versions: 1.2.0

Original Wordfence record

MediumCVE-2025-4659

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure

Published: May 29, 2025

Affected versions: *-1.4.4
Patched versions: 1.4.5

Original Wordfence record

MediumCVE-2024-34755

Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery

Published: May 14, 2024

Affected versions: *-1.3.9
Patched versions: 1.4.0

Original Wordfence record

MediumCVE-2025-67468

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization

Published: December 8, 2025

Affected versions: *-1.4.6
Patched versions: 1.4.7

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory