Plugin icon

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

wpforms-lite

Vulnerabilities:

14

Last Updated:

December 11, 2025

Active Installs:

6000000

Published
Title
Fixed in
CVSS
Published
2025-05-09
Title
WPForms Lite < 1.9.5.1 - Contributor+ Stored XSS via 'start_timestamp' Parameter
Fixed in
Fixed in 1.9.5.1
CVSS
5.9 (medium)
Published
2025-02-03
Title
WPForms Lite < 1.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
Fixed in
Fixed in 1.9.3.2
CVSS
6.4 (medium)
Published
2025-01-03
Title
Contact Form by WPForms < 1.9.2.3 - Contributor+ Custom Form Theme Creation
Fixed in
Fixed in 1.9.2.3
CVSS
2.7 (low)
Published
2024-12-09
Title
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
Fixed in
Fixed in 1.9.2.2
CVSS
8.5 (high)
Published
2024-12-05
Title
WPForms < 1.9.2.3 - Admin+ Stored XSS
Fixed in
Fixed in 1.9.2.3
CVSS
3.5 (low)
Published
2024-11-12
Title
WPForms – Easy Form Builder for WordPress < 1.9.2.1 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
Fixed in
Fixed in 1.9.2.1
CVSS
4.3 (medium)
Published
2024-11-04
Title
WPForms < 1.9.1.6 - Admin+ Stored XSS
Fixed in
Fixed in 1.9.1.6
CVSS
3.5 (low)
Published
2024-05-01
Title
Contact Form by WPForms – Drag & Drop Form Builder for WordPress < 1.8.8.2 - Unauthenticated Price Manipulation
Fixed in
Fixed in 1.8.8.2
CVSS
5.3 (medium)
Published
2023-06-20
Title
Contact Form by WPForms < 1.8.1.3 - Reflected XSS
Fixed in
Fixed in 1.8.1.3
CVSS
5.8 (medium)
Published
2022-09-19
Title
Contact Form by WPForms < 1.7.5.5 - Admin+ Arbitrary File Access
Fixed in
Fixed in 1.7.5.5
CVSS
4.3 (medium)
Published
2020-07-01
Title
Contact Form by WPForms < 1.6.0.2 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.6.0.2
CVSS
6.6 (medium)
Published
2020-03-05
Title
Contact Form by WPForms < 1.5.9 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.5.9
CVSS
5.4 (medium)
Published
2018-12-10
Title
Contact Form by WPForms < 1.4.8.1 - Unauthenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.4.8.1
CVSS
6.5 (medium)
Published
2018-12-02
Title
Contact Form by WPForms < 1.4.8 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.4.8
CVSS
5.4 (medium)