Conditional fields in Contact Form 7 Security & Risk Analysis
wordpress.org/plugins/conditional-fields-in-contact-form-7Adds conditional logic to Contact Form 7.
Is Conditional fields in Contact Form 7 Safe to Use in 2026?
Generally Safe
Score 85/100Conditional fields in Contact Form 7 has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.
The plugin "conditional-fields-in-contact-form-7" v1.0.4 exhibits several concerning security practices despite a clean vulnerability history. A significant portion of its attack surface consists of AJAX handlers that lack proper authentication checks, creating potential entry points for unauthorized actions. Furthermore, a substantial percentage of output is not properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is mishandled.
The absence of nonce checks on these unprotected AJAX handlers is a critical oversight. While there are no recorded CVEs and the taint analysis shows no immediate critical or high severity issues, the static analysis reveals weaknesses that could be exploited. The plugin demonstrates good practice with prepared SQL statements, but this is overshadowed by the issues with AJAX authentication and output escaping.
In conclusion, while the plugin has no known historical vulnerabilities, its current implementation presents tangible risks due to unprotected AJAX endpoints and insufficient output escaping. These factors necessitate careful review and potential remediation to improve its overall security posture.
Key Concerns
- AJAX handlers without auth checks
- Low percentage of properly escaped output
- Missing nonce checks on AJAX
Conditional fields in Contact Form 7 Security Vulnerabilities
Conditional fields in Contact Form 7 Code Analysis
Output Escaping
Conditional fields in Contact Form 7 Attack Surface
AJAX Handlers 3
WordPress Hooks 20
Maintenance & Trust
Conditional fields in Contact Form 7 Maintenance & Trust
Maintenance Signals
Community Trust
Conditional fields in Contact Form 7 Alternatives
Database Addon for Contact Form 7 – CFDB7
contact-form-cfdb7
Save and manage Contact Form 7 messages. Never lose important data. It is a lightweight contact form 7 database plugin.
ReCaptcha v2 for Contact Form 7
wpcf7-recaptcha
Adds reCaptcha v2 from Contact Form 7 5.0.5 that was dropped on Contact Form 7 5.1
Redirection for Contact Form 7
wpcf7-redirect
Redirect to any page or URL, execute scripts after submission, save data to the database, and unlock additional submission actions for Contact Form 7.
Conditional Fields for Contact Form 7
cf7-conditional-fields
Adds conditional logic to Contact Form 7.
Contact Form 7 – Dynamic Text Extension
contact-form-7-dynamic-text-extension
Extends Contact Form 7 by adding dynamic form fields that accepts shortcodes to prepopulate form fields with default values and dynamic placeholders.
Conditional fields in Contact Form 7 Developer Profile
3 plugins · 60 total installs
How We Detect Conditional fields in Contact Form 7
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.