WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpforms
Published
2026-07-24
Title
WPForms Pro < 2.0.0 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
Slug
wpforms
Published
2026-08-20
Title
WPForms Pro < 2.0.0.3 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
Slug
wpforms-lite
Published
2018-12-02
Title
Contact Form by WPForms < 1.4.8 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
wpforms-lite
Published
2018-12-10
Title
Contact Form by WPForms < 1.4.8.1 - Unauthenticated Cross-Site Scripting (XSS)
Slug
wpforms-lite
Published
2020-03-05
Title
Contact Form by WPForms < 1.5.9 - Authenticated Cross-Site Scripting (XSS)
Slug
wpforms-lite
Published
2020-07-01
Title
Contact Form by WPForms < 1.6.0.2 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
wpforms-lite
Published
2022-09-19
Title
Contact Form by WPForms < 1.7.5.5 - Admin+ Arbitrary File Access
Slug
wpforms-lite
Published
2023-06-20
Title
Contact Form by WPForms < 1.8.1.3 - Reflected XSS
Slug
wpforms-lite
Published
2024-05-01
Title
Contact Form by WPForms – Drag & Drop Form Builder for WordPress < 1.8.8.2 - Unauthenticated Price Manipulation
Slug
wpforms-lite
Published
2024-11-04
Title
WPForms < 1.9.1.6 - Admin+ Stored XSS
Slug
wpforms-lite
Published
2024-11-12
Title
WPForms – Easy Form Builder for WordPress < 1.9.2.1 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
Slug
wpforms-lite
Published
2024-12-05
Title
WPForms < 1.9.2.3 - Admin+ Stored XSS
Slug
wpforms-lite
Published
2024-12-09
Title
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
Slug
wpforms-lite
Published
2025-01-03
Title
Contact Form by WPForms < 1.9.2.3 - Contributor+ Custom Form Theme Creation
Slug
wpforms-lite
Published
2025-02-03
Title
WPForms Lite < 1.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
Slug
wpforms-lite
Published
2025-05-09
Title
WPForms Lite < 1.9.5.1 - Contributor+ Stored XSS via 'start_timestamp' Parameter
Slug
wpforms-lite
Published
2026-03-23
Title
WPForms < 1.9.9.2 - Unauthenticated Sensitive Information Exposure
Slug
wpforms-lite
Published
2026-03-07
Title
Contact Form by WPForms < 1.9.9.4 - Missing Authorization
Slug
wpforms-lite
Published
2026-03-31
Title
Contact Form by WPForms < 1.10.0.3 - Cross-Site Request Forgery
Slug
wpforms-lite
Published
2026-05-19
Title
WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
Slug
wpforms-lite
Published
2026-05-28
Title
WPForms < 1.10.0.5 - Unauthenticated Missing Authorization
Slug
wpforms-lite
Published
2026-06-30
Title
WPForms < 1.10.2.1 - Unauthenticated CRLF Email Header Injection via Reply-To Display Name
Slug
wpforms-lite
Published
2026-07-20
Title
WPForms < 2.0.0.2 - Contributor+ Stored Cross-Site Scripting via OptinMonster Integration
Slug
wpforms-lite
Published
2026-09-24
Title
WPForms < 2.0.2.1 - Reflected XSS via 'page_title' Parameter
Slug
wpforms-lite
Published
2026-09-22
Title
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent