Read the docs

WPForms

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

WPForms records in CISA KEV

No WPForms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wpforms 9 records MEDIUM Contact Form 4 records MEDIUM Pirate Forms 1 record MEDIUM Wp Mail Smtp 1 record LOW Wpforms Pro 1 record HIGH

Records

9 records in Wpforms · all components

TI-2020-19054 CVE-2020-36919 · GHSA-jr34-h398-5f6x

WPForms 1.7.8 - Cross-Site Scripting (XSS)

Priority MEDIUM 56

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00375 Published 2026-01-13 No fix listed CWE-79
TI-2024-10397 CVE-2024-11223 · GHSA-447r-cxfc-3q93

WPForms < 1.9.2.3 - Admin+ Stored XSS

Priority MEDIUM 55

The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00523 Published 2024-12-26 Fixed in 1.9.2.3 CWE-79
TI-2024-37245 CVE-2024-56276 · GHSA-rpqq-f9fv-4hwq

WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00399 Published 2025-01-07 No fix listed CWE-862
TI-2024-10379 CVE-2024-11205 · GHSA-w65x-762v-xpf6

Missing authorization in smub WPForms – Easy Form Builder for WordPress – Contact Forms…

Priority LOW 38

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00722 Published 2024-12-10 No fix listed CWE-862
TI-2023-06459 CVE-2023-7063 · GHSA-7v3h-fr8r-9pvm

Cross-site scripting in WPForms Pro

Priority LOW 38

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0053 Published 2024-01-20 No fix listed CWE-79
TI-2024-12445 CVE-2024-13403 · GHSA-gq2f-g8mp-6phg

WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

Priority LOW 29

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and inc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00386 Published 2025-02-04 No fix listed CWE-79
TI-2024-09815 CVE-2024-10593 · GHSA-5v4f-6fm8-6xv7

WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

Priority LOW 20

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00272 Published 2024-11-13 No fix listed CWE-352
TI-2024-06538 CVE-2024-7056 · GHSA-8pvr-h3wm-pfpm

WPForms < 1.9.1.6 - Admin+ Stored XSS

Priority LOW 17

The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00448 Published 2024-11-25 Fixed in 1.9.1.6 CWE-79
Open these records in search →