Wpforms (Unknown) - vulnerabilities (CVEs)
8 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-09-28. Vendor: Unknown.
CVEs of Wpforms
- CVE-2026-84744 - CVSS 6.5 (medium), 2026-09-28: The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the…
- CVE-2026-74991 - CVSS 6.8 (medium), 2026-09-24: The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on…
- CVE-2026-14872 - CVSS 6.8 (medium), 2026-08-04: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a…
- CVE-2026-14870 - CVSS 7.1 (high), 2026-07-28: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it…
- CVE-2026-12081 - CVSS 5 (medium), 2026-07-13: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an…
- CVE-2026-4986 - CVSS 5.3 (medium), 2026-06-09: The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing…
- CVE-2024-11223 - CVSS 4.7 (medium), 2024-12-26: The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
- CVE-2024-7056 - CVSS 3.5 (low), 2024-11-25: The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform…
