All products
wpforms-lite
WordPress · Plugin28 reports| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More <= 2.0.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-54851 |
wpforms-lite |
WordPress |
High
|
Fix reported |
|
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass on Paid FormsCVE-2026-82844 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc AttributeCVE-2026-101921 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2026-84744 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing AuthorizationCVE-2026-74991 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST ParameterCVE-2026-88996 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms Lite <= 1.10.0.4 - Unauthenticated Payment BypassCVE-2026-4986 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post ContentCVE-2026-15782 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display NameCVE-2026-12127 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook EndpointCVE-2026-7792 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing AuthorizationCVE-2026-48835 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request ForgeryCVE-2026-40764 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| Contact Form by WPForms <= 1.9.9.3 - Missing AuthorizationCVE-2026-32446 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information ExposureCVE-2026-25339 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' ParameterCVE-2025-3794 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML ParameterCVE-2024-13403 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| Contact Form by WPForms <= 1.9.2.2 - Missing AuthorizationCVE-2024-56276 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site ScriptingCVE-2024-11223 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
| WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription CancellationCVE-2024-11205 |
wpforms-lite |
WordPress |
High
|
Fix reported |
|
| WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2024-7056 |
wpforms-lite |
WordPress |
Medium
|
Fix reported |
|
