Plugin security history

Contact Form Email Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 17 vulnerability records associated with Contact Form Email, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

17Total records

0Critical

5High

12Medium

0Low

0Informational

17Patched records

0Currently marked unpatched

2014-11-22First disclosure

2026-03-23Latest disclosure

13 of 17CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2015	1	1 records
2016	1	1 records
2019	3	3 records
2021	1	1 records
2023	5	5 records
2024	1	1 records
2025	3	3 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	5	29.4%
Medium	12	70.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records47.1%

First: 2014. Latest: 2025.

Missing Authorization

4 records23.5%

First: 2023. Latest: 2026.

CSRF

3 records17.6%

First: 2015. Latest: 2023.

Other

1 record5.9%

First: 2023. Latest: 2023.

Information Disclosure

1 record5.9%

First: 2024. Latest: 2024.

Patch Status

Patched: 17
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.3.64
1.3.61
1.3.59
1.3.53
1.3.45
1.3.42
1.3.44
1.3.38
1.3.32
1.3.25
1.2.66
1.1.48
1.3.12
1.0.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.3.63`	Contact Form Email <= 1.3.63 - Missing Authorization	March 23, 2026	1.3.64	Medium
`*-1.3.60`	Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference	December 1, 2025	1.3.61	Medium
`*-1.3.58`	Contact Form Email <= 1.3.58 - Missing Authorization	November 15, 2025	1.3.59	Medium
`*-1.3.52`	Contact Form Email <= 1.3.52 - Authenticated (Administrator+) Stored Cross-Site Scripting	January 24, 2025	1.3.53	Medium
`*-1.3.44`	Contact Form Email <= 1.3.44 - Unauthenticated Sensitive Information Exposure	April 5, 2024	1.3.45	Medium
`*-1.3.41`	Contact Form Email <= 1.3.41 - Captcha Bypass	November 23, 2023	1.3.42	Medium
`*-1.3.43`	Contact Form Email <= 1.3.43 - Authenticated (Admin+) Stored Cross-Site Scripting	November 14, 2023	1.3.44	Medium
`*-1.3.37`	Contact Form Email <= 1.3.37 - Unauthenticated Stored Cross-Site Scripting	May 16, 2023	1.3.38	High
`*-1.3.31`	Contact Form Email <= 1.3.31 - Cross-Site Request Forgery to Feedback Submission	March 21, 2023	1.3.32	Medium
`*-1.3.31`	Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission	March 16, 2023	1.3.32	Medium
`*-1.3.24`	Contact Form Email <= 1.3.24 - Authenticated (Admin+) Stored Cross-Site Scripting	November 11, 2021	1.3.25	Medium
`*-1.2.65`	Contact Form Email <= 1.2.65 - Cross-Site Request Forgery	August 12, 2019	1.2.66	High
`*-1.2.65`	Contact Form Email <= 1.2.65 - Cross-Site Scripting	August 12, 2019	1.2.66	Medium
`[*, 1.2.66)`	Contact Form Email <= 1.2.65 - Reflected Cross-Site Scripting	February 5, 2019	1.2.66	Medium
`[*, 1.1.48)`	Contact Form Email < 1.1.48 - Reflected Cross-Site Scripting	July 24, 2016	1.1.48	High
`[*, 1.3.12)`	Contact Form Email <= 1.3.11 - Cross-Site Request Forgery to Cross-Site Scripting	May 13, 2015	1.3.12	High
`[*, 1.0.1)`	Contact Form Email < 1.0.1 - Cross-Site Scripting	November 22, 2014	1.0.1	High

Selected source records

Latest Records

MediumCVE-2026-32483

Contact Form Email <= 1.3.63 - Missing Authorization

Published: March 23, 2026

Affected versions: *-1.3.63
Patched versions: 1.3.64

Original Wordfence record

MediumCVE-2025-10019

Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference

Published: December 1, 2025

Affected versions: *-1.3.60
Patched versions: 1.3.61

Original Wordfence record

MediumCVE-2025-64369

Contact Form Email <= 1.3.58 - Missing Authorization

Published: November 15, 2025

Affected versions: *-1.3.58
Patched versions: 1.3.59

Original Wordfence record

MediumCVE-2025-24727

Contact Form Email <= 1.3.52 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-1.3.52
Patched versions: 1.3.53

Original Wordfence record

MediumCVE-2024-31302

Contact Form Email <= 1.3.44 - Unauthenticated Sensitive Information Exposure

Published: April 5, 2024

Affected versions: *-1.3.44
Patched versions: 1.3.45

Original Wordfence record

MediumCVE-2023-48318

Contact Form Email <= 1.3.41 - Captcha Bypass

Published: November 23, 2023

Affected versions: *-1.3.41
Patched versions: 1.3.42

Original Wordfence record

MediumCVE-2023-5955

Contact Form Email <= 1.3.43 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: November 14, 2023

Affected versions: *-1.3.43
Patched versions: 1.3.44

Original Wordfence record

HighCVE-2023-2718

Contact Form Email <= 1.3.37 - Unauthenticated Stored Cross-Site Scripting

Published: May 16, 2023

Affected versions: *-1.3.37
Patched versions: 1.3.38

Original Wordfence record

Highest-Severity Records

HighCVE-2018-20964

Contact Form Email <= 1.2.65 - Cross-Site Request Forgery

Published: August 12, 2019

Affected versions: *-1.2.65
Patched versions: 1.2.66

Original Wordfence record

High

Contact Form Email <= 1.3.11 - Cross-Site Request Forgery to Cross-Site Scripting

Published: May 13, 2015

Affected versions: [*, 1.3.12)
Patched versions: 1.3.12

Original Wordfence record

HighCVE-2023-2718

Contact Form Email <= 1.3.37 - Unauthenticated Stored Cross-Site Scripting

Published: May 16, 2023

Affected versions: *-1.3.37
Patched versions: 1.3.38

Original Wordfence record

High

Contact Form Email < 1.0.1 - Cross-Site Scripting

Published: November 22, 2014

Affected versions: [*, 1.0.1)
Patched versions: 1.0.1

Original Wordfence record

High

Contact Form Email < 1.1.48 - Reflected Cross-Site Scripting

Published: July 24, 2016

Affected versions: [*, 1.1.48)
Patched versions: 1.1.48

Original Wordfence record

MediumCVE-2019-9646

Contact Form Email <= 1.2.65 - Reflected Cross-Site Scripting

Published: February 5, 2019

Affected versions: [*, 1.2.66)
Patched versions: 1.2.66

Original Wordfence record

MediumCVE-2018-20963

Contact Form Email <= 1.2.65 - Cross-Site Scripting

Published: August 12, 2019

Affected versions: *-1.2.65
Patched versions: 1.2.66

Original Wordfence record

MediumCVE-2024-31302

Contact Form Email <= 1.3.44 - Unauthenticated Sensitive Information Exposure

Published: April 5, 2024

Affected versions: *-1.3.44
Patched versions: 1.3.45

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory