WP
Vendor
Wpforms
19
CVEs
0
On KEV
0
New 30D
Products
WP8.8
Wpforms
Wpforms
9 CVEs0 on KEV0 new
CF6.1
Contact Form
Wpforms
4 CVEs0 on KEV0 new
WP9.8
WPForms Pro
WPForms
3 CVEs0 on KEV0 new
PF6.1
Pirate Forms
Wpforms
1 CVEs0 on KEV0 new
WM5.3
WP Mail Smtp
Wpforms
1 CVEs0 on KEV0 new
WU8.0
Wpforms User Registration
Wpforms
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-18409 | WP WPForms Pro WPForms | 7.2 | Aug 21 | WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values |
| CVE-2026-10818 | WP WPForms Pro WPForms | 8.1 | Jul 25 | WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering |
| CVE-2020-36919 | WP Wpforms Wpforms | 6.1 | Jan 13 | WPForms 1.7.8 - Cross-Site Scripting (XSS) |
| CVE-2024-11273 | CF Contact Form Wpforms | 6.1 | Mar 25 | Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS |
| CVE-2024-11272 | PF Pirate Forms Wpforms | 6.1 | Mar 25 | Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS |
| CVE-2024-13403 | WP Wpforms Wpforms | 5.4 | Feb 4 | WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter |
| CVE-2024-56276 | WP Wpforms Wpforms | 8.8 | Jan 7 | WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability |
| CVE-2024-11223 | WP Wpforms Wpforms | 4.7 | Dec 26 | WPForms < 1.9.2.3 - Admin+ Stored XSS |
| CVE-2024-11205 | WP Wpforms Wpforms | 6.5 | Dec 10 | WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation |
| CVE-2024-7056 | WP Wpforms Wpforms | 3.5 | Nov 25 | WPForms < 1.9.1.6 - Admin+ Stored XSS |
| CVE-2024-10593 | WP Wpforms Wpforms | 4.3 | Nov 13 | WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion |
| CVE-2023-52209 | WU Wpforms User Registration Wpforms | 8.0 | Aug 1 | WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability |
| CVE-2023-7063 | WP Wpforms Wpforms | 6.1 | Jan 20 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient… |
| CVE-2023-3213 | WM WP Mail Smtp Wpforms | 5.3 | Oct 4 | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and… |
| CVE-2023-30500 | WP Wpforms Wpforms | 6.1 | Jun 22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions |
| CVE-2019-25145 | CF Contact Form Wpforms | 6.1 | Jun 7 | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and… |
| CVE-2022-3574 | WP Wpforms Pro Wpforms | 9.8 | Nov 14 | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection |
| CVE-2020-10385 | CF Contact Form Wpforms | 5.4 | Mar 24 | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress |