Plugin icon

MW WP Form

mw-wp-form

Vulnerabilities:

8

Last Updated:

April 27, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-05-13
Title
MW WP Form < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
Fixed in
Fixed in 5.1.3
CVSS
5.3 (medium)
Published
2026-04-08
Title
MW WP Form < 5.1.2 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
Fixed in
Fixed in 5.1.2
CVSS
8.1 (high)
Published
2026-04-01
Title
MW WP Form < 5.1.1 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Fixed in
Fixed in 5.1.1
CVSS
8.1 (high)
Published
2024-01-31
Title
MW WP Form < 5.1.0 - Editor+ Stored XSS
Fixed in
Fixed in 5.1.0
CVSS
4.8 (medium)
Published
2023-12-15
Title
MW WP Form < 5.0.4 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 5.0.4
CVSS
7.5 (high)
Published
2023-12-04
Title
MW WP Form < 5.0.2 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 5.0.2
CVSS
8.1 (high)
Published
2023-10-19
Title
MW WP Form < 5.0.0 - Missing Authorization
Fixed in
Fixed in 5.0.0
CVSS
5.3 (medium)
Published
2023-05-15
Title
MW WP Form < 4.4.3 - Unauthenticated Path Traversal
Fixed in
Fixed in 4.4.3
CVSS
5.3 (medium)