Contact Form 7
At risk: no release in 24 months (last release 22 Oct 2024).
Capped at 59: a Critical signal is open.
| Ownership | 100 |
|---|---|
| Maintenance | 0 |
| Security | 100 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is Contact Form 7 still maintained?
- No. Last release 22 Oct 2024, over 2 years ago. 22 Oct 2024 · wordpress.org
- Who owns Contact Form 7, and has it changed hands?
- No change recorded. 3 Nov 2026 · SVN log
- Was Contact Form 7 removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is Contact Form 7 safe?
- 1 known vulnerability, fixed (latest in 2.0.2). Not on the exploited list. 23 Oct 2024 · Wordfence Intelligence
- Is the latest Contact Form 7 update safe to install?
- No ownership change before 2.0.2. No one-star spike after it. 22 Oct 2024 · Release history
Active signals
Facts we detected, with links to the source.
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| felipeelia | 19 Mar 2018 to 22 Oct 2024, 30 commits |
|---|
1 committer recorded. No ownership change since 2018.
Maintenance
- Last release
- 2 years ago
- Releases, 24 months
- 0
- Tested up to
- 6.6 vs 7.1
- Requires PHP
- 7.2 supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 1 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 22 Oct 2024. Tested up to 6.6, 5 major versions behind WordPress 7.1.
Reputation
Last 90 days: no reviews. Lifetime: 4.3.
| 5 star | 17 |
|---|---|
| 4 star | 0 |
| 3 star | 1 |
| 2 star | 0 |
| 1 star | 3 |
Security record
1 vulnerability on record, patched (latest fixed in 2.0.2).
Show 1 patched vulnerability
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 23 Oct 2024 | Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode | 6.4 | <= 2.0.1 | 2.0.2 | Patched before disclosure |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
Support history appears after our first snapshots of the forum counts.
Momentum
6,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 26 |
|---|---|
| 11 May 2026 | 120 |
| 18 May 2026 | 102 |
| 25 May 2026 | 129 |
| 1 Jun 2026 | 122 |
| 8 Jun 2026 | 107 |
| 15 Jun 2026 | 83 |
| 22 Jun 2026 | 80 |
| 29 Jun 2026 | 88 |
| 6 Jul 2026 | 103 |
| 13 Jul 2026 | 79 |
| 20 Jul 2026 | 127 |
| 27 Jul 2026 | 107 |
| 3 Aug 2026 | 149 |
| 10 Aug 2026 | 115 |
| 17 Aug 2026 | 99 |
| 24 Aug 2026 | 93 |
| 31 Aug 2026 | 122 |
| 7 Sep 2026 | 117 |
| 14 Sep 2026 | 150 |
| 21 Sep 2026 | 172 |
| 28 Sep 2026 | 178 |
| 5 Oct 2026 | 142 |
| 12 Oct 2026 | 129 |
| 19 Oct 2026 | 189 |
| 26 Oct 2026 | 197 |
| 2 Nov 2026 | 31 |
Weekly downloads over the last 4 weeks are 17% above the 27-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
Facts
| Version | 2.0.2 |
|---|---|
| Author | Felipe Elia |
| Added | 19 Mar 2018 |
| Last updated | 22 Oct 2024 |
| Active installs | 6,000+ |
| Requires WordPress | 6.0 |
| Tested up to | 6.6.11 |
| Requires PHP | 7.2 |
| Category | Forms & Data Collection > Form Builders & Creators |
| Tags | cf7, repeater, repeatable, contact form 7 |
Other plugins by this author: CFS Auto Loop Label, CFS - Contact Form 7 Field
Questions
Is Contact Form 7 still maintained?
No. Last release 22 Oct 2024, over 2 years ago.
Who owns Contact Form 7, and has it changed hands?
No change recorded.
Was Contact Form 7 removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is Contact Form 7 safe?
1 known vulnerability, fixed (latest in 2.0.2). Not on the exploited list.
Is the latest Contact Form 7 update safe to install?
No ownership change before 2.0.2. No one-star spike after it.