Vulnerability CVE-2025-60081

  • spadamar

    (@spadamar)


    1 month ago

    I have received a notification from Plesk stating that the “Generate PDF using Contact Form 7” plugin (version 4.2.1) is affected by the vulnerability identified as CVE-2025-60081 (https://www.cve.org/CVERecord?id=CVE-2025-60081). I would like to know if a new version of the plugin addressing this vulnerability is planned, and if so, what the expected timeframe for its release is.

Viewing 2 replies - 1 through 2 (of 2 total)
  • MeraX

    (@merax)

    3 weeks, 2 days ago

    If you click through patchstack.com, you’ll figure out, that the CVE affects another plugin with a similar name. https://wordpress.org/support/plugin/pdf-for-contact-form-7/

    Cristopher

    (@cristopherzwt)

    2 weeks, 6 days ago

    Hello spadamar,

    Thank you for sharing the Plesk security notification regarding CVE-2025-60081.

    We reviewed this carefully. The CVE applies to a different plugin:

    • Affected plugin: “PDF for Contact Form 7” by add-ons.org (pdf-for-contact-form-7)
    • Plugin on your site: “Generate PDF using Contact Form 7” by ZealousWeb (generate-pdf-using-contact-form-7)

    We also checked our ZealousWeb plugin for the same type of issue (unsafe data deserialization / object injection). We did not find that vulnerability in your plugin.

    Best regards,
    ZealousWeb Support

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.