What’s Vulnerable › Vulnerabilities

CVE-2023-31095: WordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-29 · updated 2026-06-17
• Weakness: CWE-601

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.

Affected products

• crmperks Database for Contact Form 7, WPforms, Elementor forms: before 1.2.9 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: crmperks Database for Contact Form 7, WPforms, Elementor forms 1.2.9. Check the vendor advisory for mitigations.

References

• https://patchstack.com/database/vulnerability/cf7-hubspot/wordpress-integration-for-contact-form-7-hubspot-plugin-1-2-8-open-redirection-vulnerability?_s_id=cve
• https://patchstack.com/database/vulnerability/cf7-hubspot/wordpress-integration-for-contact-form-7-hubspot-plugin-1-2-8-open-redirection-vulnerability?_s_id=cve

Get alerted when CVE-2023-31095 or the next vulnerability affects your stack