Skip to content
Noroxi

WPForms records

16 published records for vendor wpforms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
50%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

16 records
  • CVE-2022-3574
    39Monitor

    WPForms Pro < 1.7.7 - CSV Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    wpforms · wpforms proNov 14, 2022

  • CVE-2024-56276
    35Monitor

    WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    wpforms · wpformsJan 7, 2025

  • CVE-2023-52209
    32Monitor

    WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability

    HighCVSS 8.0No exploitEPSS 0%

    wpforms, llc. · wpforms user registrationAug 1, 2024

  • CVE-2024-11205
    26Monitor

    WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

    MediumCVSS 6.5No exploitEPSS 1%

    wpforms · wpformsDec 10, 2024

  • CVE-2019-25145
    24Monitor

    Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

    MediumCVSS 6.1No exploitEPSS 1%

    wpforms · contact formJun 6, 2023

  • CVE-2023-7063
    24Monitor

    The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and

    MediumCVSS 6.1No exploitEPSS 1%

    wpforms · wpformsJan 20, 2024

  • CVE-2023-30500
    24Monitor

    WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    wpforms · contact formJun 22, 2023

  • CVE-2024-11272
    24Monitor

    Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

    MediumCVSS 6.1No exploitEPSS 0%

    wpforms · pirate formsMar 25, 2025

  • CVE-2024-11273
    24Monitor

    Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

    MediumCVSS 6.1No exploitEPSS 0%

    wpforms · contact formMar 25, 2025

  • CVE-2020-10385
    22Monitor

    A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

    MediumCVSS 5.4Proof of conceptEPSS 4%

    wpforms · contact formMar 24, 2020

  • CVE-2023-3213
    21Monitor

    WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page

    MediumCVSS 5.3No exploitEPSS 0%

    wpforms · wp mail smtpOct 3, 2023

  • CVE-2024-13403
    21Monitor

    WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

    MediumCVSS 5.4No exploitEPSS 0%

    wpforms · wpformsFeb 4, 2025

  • CVE-2020-36919
    20Monitor

    WPForms 1.7.8 - Cross-Site Scripting (XSS)

    MediumCVSS 5.1No exploitEPSS 0%

    wpforms · wpformsJan 13, 2026

  • CVE-2024-11223
    18Monitor

    WPForms < 1.9.2.3 - Admin+ Stored XSS

    MediumCVSS 4.7No exploitEPSS 1%

    wpforms · wpformsDec 26, 2024

  • CVE-2024-10593
    17Monitor

    WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

    MediumCVSS 4.3No exploitEPSS 0%

    wpforms · wpformsNov 12, 2024

  • CVE-2024-7056
    14Monitor

    WPForms < 1.9.1.6 - Admin+ Stored XSS

    LowCVSS 3.5No exploitEPSS 0%

    wpforms · wpformsNov 25, 2024