PLUGIN SECURITY
Is Cf7 Google Sheets Connector safe?
Send Contact Form 7 submissions to Google Sheets automatically in real time and keep every form entry organized and easy to access.
What this plugin does
- Slug:
cf7-google-sheets-connector - Author: WesternDeal
- 40000+ active installs
- 88/100 rating (129 reviews on wordpress.org)
- 1029277 all-time downloads
- On WordPress.org since 2016-09-02
cf7contact form 7form submissionsGoogle Sheetsgoogle sheets integration
Maintenance status
- Latest known version: 5.2.3
- Last updated: 2026-08-15 10:56am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
5 known CVEs on file for Cf7 Google Sheets Connector. Reported between 2023 and 2025.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-22686 | GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector] < 5.0.18 | Missing Authorization | Medium 5.3 | < 5.0.18 | 5.0.18 | 2025-01-31 | ✓ fixed in latest |
| CVE-2026-16614 | GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector] < 5.2.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 5.2.2 | 5.2.2 | 2025-01-31 | ✓ fixed in latest |
| CVE-2024-5654 | GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector] < 5.0.10 | Missing Authorization | Medium 6.5 | < 5.0.10 | 5.0.10 | 2024-06-07 | ✓ fixed in latest |
| CVE-2023-44989 | GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector] < 5.0.6 | Insertion of Sensitive Information into Log File | High 7.5 | < 5.0.6 | 5.0.6 | 2023-11-30 | ✓ fixed in latest |
| CVE-2023-2320 | GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector] < 5.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.0.2 | 5.0.2 | 2023-06-12 | ✓ fixed in latest |
How to fix it
Keep Cf7 Google Sheets Connector updated — 5.2.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Database Addon for Contact Form 7 – CFDB7 — 600000+ active installs — 100/100 (1874) — max PHP 8.4
- Redirection for Contact Form 7 — 200000+ active installs — 94/100 (275) — max PHP 8.4
- ReCaptcha v2 for Contact Form 7 — 200000+ active installs — 100/100 (89) — max PHP 8.4
- Conditional Fields for Contact Form 7 — 100000+ active installs — 96/100 (166) — max PHP 8.4
- DTX – Dynamic Text Extension for Contact Form 7 — 100000+ active installs — 94/100 (99)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.