PLUGIN SECURITY
Is Cf7 Conditional Fields safe?
Adds conditional logic to Contact Form 7.
What this plugin does
- Slug:
cf7-conditional-fields - Author: Jules Colle
- 100000+ active installs
- 96/100 rating (166 reviews on wordpress.org)
- 6931165 all-time downloads
- On WordPress.org since 2016-06-01
conditional fieldsconditional logiccontact form 7formforms
Maintenance status
- Latest known version: 2.7.10
- Last updated: 2026-08-17 12:13pm GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
4 known CVEs on file for Cf7 Conditional Fields. Reported between 2023 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-25863 | Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.7.3 | Improper Validation of Specified Quantity in Input | High 7.5 | < 2.7.3 | 2.7.3 | 2026-05-04 | ✓ fixed in latest |
| CVE-2024-50412 | Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 2.5 | 2.5 | 2024-10-24 | ✓ fixed in latest |
| CVE-2024-5804 | Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.14 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 2.4.14 | 2.4.14 | 2024-07-19 | ✓ fixed in latest |
| CVE-2023-47838 | Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.2 | Missing Authorization | Medium 4.3 | < 2.4.2 | 2.4.2 | 2023-11-16 | ✓ fixed in latest |
| — | Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.1 | — | Unknown | < 2.4.1 | 2.4.1 | 2023-11-14 | ✓ fixed in latest |
How to fix it
Keep Cf7 Conditional Fields updated — 2.7.10 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Visibility Logic for Elementor — 20000+ active installs — 96/100 (58) — max PHP 8.4
- Conditional Fields for Elementor Form – Apply Conditional Logic — 10000+ active installs — 94/100 (32) — max PHP 8.4
- If-So Dynamic Content – Elementor & All Page Builders Personalization — 7000+ active installs — 94/100 (92) — max PHP <8.0
- CubeWP Forms — 3000+ active installs
- Conditional Logic Emails, Fields, Redirect for Elementor Forms — 2000+ active installs — 86/100 (11)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.