CVE-2026-10818 | High | 8.1 | 2026-07-25 | The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize f… |
CVE-2020-36919 | Medium | 6.1 | 2026-01-13 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts throu… |
CVE-2024-11273 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-11272 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-13403 | Medium | 6.4 | 2025-02-04 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-56276 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-11223 | Medium | 4.7 | 2024-12-26 | The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11205 | High | 8.5 | 2024-12-10 | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function i… |
CVE-2024-7056 | Low | 3.5 | 2024-11-25 | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform… |
CVE-2024-10593 | Medium | 4.3 | 2024-11-13 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2023-7063 | High | 7.2 | 2024-01-20 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3… |
CVE-2023-3213 | Medium | 5.3 | 2023-10-04 | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versi… |
CVE-2023-30500 | Medium | 5.8 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions. |
CVE-2019-25145 | High | 7.2 | 2023-06-07 | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in version… |
CVE-2022-3574 | Critical | 9.8 | 2022-11-14 | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. |
CVE-2020-10385 | Medium | 5.4 | 2020-03-24 | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. |