Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 32

Reset filters

Medium 09.10.2026

CVE-2026-101921

WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

A reflected cross-site scripting vulnerability in WPForms allows unauthenticated attackers to execute scripts if a user clicks a malicious link under specific form description configurations.

Medium 24.09.2026

CVE-2026-88996

WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

Medium 24.09.2026

CVE-2026-84744

WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution

Medium 22.09.2026

CVE-2026-74991

WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization

Medium 20.07.2026

CVE-2026-15782

WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

Medium 30.06.2026

CVE-2026-12127

WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

Medium 05.06.2026

CVE-2026-7792

WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

Medium 28.05.2026

CVE-2026-42742

Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection

Medium 28.05.2026

CVE-2026-48835

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization

Medium 19.05.2026

CVE-2026-4986

WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass

Medium 31.03.2026

CVE-2026-40764

Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery

Medium 23.03.2026

CVE-2026-25339

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure

Medium 07.03.2026

CVE-2026-32446

Contact Form by WPForms <= 1.9.9.3 - Missing Authorization

Medium 09.05.2025

CVE-2025-3794

WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

Medium 03.02.2025

CVE-2024-13403

WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

Medium 03.01.2025

CVE-2024-56276

Contact Form by WPForms <= 1.9.2.2 - Missing Authorization

High 09.12.2024

CVE-2024-11205

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

Medium 05.12.2024

CVE-2024-11223

WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Medium 12.11.2024

CVE-2024-10593

WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

Medium 04.11.2024

CVE-2024-7056

WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Medium 01.05.2024

CVE-2024-3649

Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

Medium 24.01.2024

CVE-2024-0373

Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view

Medium 24.01.2024

CVE-2024-0371

Views for WPForms <= 3.2.2 - Missing Authorization via create_view

Medium 24.01.2024

CVE-2024-0370

Views for WPForms <= 3.2.2 - Missing Authorization via save_view

Showing 1 to 24 of 32 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 32

Know which vulnerabilities affect your application

Application security in your inbox