WPForms vulnerabilities
4 published CVEs name WPForms among the affected products.
- 4Published CVEs4 of them scored
- 2Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-18409
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
WPForms · WPForms Pro
High7.2 - CVE-2026-10818
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
WPForms · WPForms Pro
High8.1 - CVE-2023-7063
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3…
WPForms · WPForms Pro
High7.2 - CVE-2023-30500
WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability
WPForms · WPForms Lite
Medium5.8