CVE-2022-0250: Redirection-For-Contact-FORM7 Redirection For Contact Form 7

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting

Affected products

• Redirection-For-Contact-FORM7 Redirection For Contact Form 7: before 2.5.0 (fixed in 2.5.0)

Published 2022-07-04. Last modified 2026-06-17.