Plugin icon

weForms – Easy Drag & Drop Contact Form Builder For WordPress

weforms

Vulnerabilities:

10

Last Updated:

May 19, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-03-23
Title
weForms – Easy Drag & Drop Contact Form Builder For WordPress < 1.6.27 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.6.27
CVSS
8.1 (high)
Published
2026-03-10
Title
weForms < 1.6.28 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
Fixed in
Fixed in 1.6.28
CVSS
6.4 (medium)
Published
2025-12-29
Title
weForms < 1.6.26 - Missing Authorization
Fixed in
Fixed in 1.6.26
CVSS
5.3 (medium)
Published
2024-06-25
Title
Various Plugins <= Various Version - Use of Polyfill.io
Fixed in
Fixed in 1.6.24
CVSS
5.3 (medium)
Published
2024-03-28
Title
weForms < 1.6.21 - Missing Authorization
Fixed in
Fixed in 1.6.21
CVSS
5.3 (medium)
Published
2024-03-12
Title
weForms < 1.6.22 - Unauthenticated Stored Cross-Site Scripting via Referer
Fixed in
Fixed in 1.6.22
CVSS
7.2 (high)
Published
2023-12-27
Title
weForms < 1.6.19 - Missing Authorization via export_form_entries
Fixed in
Fixed in 1.6.19
CVSS
6.5 (medium)
Published
2023-12-26
Title
weForms – Easy Drag & Drop Contact Form Builder For WordPress < 1.6.18 - Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.18
CVSS
4.4 (medium)
Published
2022-07-12
Title
weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.14
CVSS
3.4 (low)
Published
2020-11-20
Title
weForms < 1.6.4 - CSV Injection
Fixed in
Fixed in 1.6.4
CVSS
6.1 (medium)