WE
Product
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
6
CVEs
0
On KEV
6.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 6Low 0
Watch
Add WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-11205 | 6.5 | Dec 10 | WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation Affected: 1.8.4 through 1.9.2.1 |
| CVE-2025-3794 | 5.4 | May 9 | WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter Affected: through 1.9.5 |
| CVE-2024-13403 | 5.4 | Feb 4 | WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter Affected: through 1.9.3.1 |
| CVE-2026-7792 | 5.3 | Jun 6 | WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint Affected: through 1.10.0.4 |
| CVE-2024-3649 | 5.3 | May 2 | Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation Affected: through 1.8.7.2 |
| CVE-2024-10593 | 4.3 | Nov 13 | WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion Affected: through 1.9.1.6 |
Showing 6