Skip to content
Noroxi

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

wpforms-lite · plugin

Known security vulnerabilities for WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

10 exploitable without logging in · 2 with public exploit code · latest Sep 25, 2026

Listed on wordpress.org · latest 2.0.2.1 · last updated Sep 23, 2026 · 5M+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-56276login required≤ 1.9.2.2

    WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

    High 8.8

  • CVE-2026-40764unauthenticated · needs a click≤ 1.10.0.2

    WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.1

  • CVE-2026-48835unauthenticated≤ 1.10.0.4

    WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-25339unauthenticated · needs a click≤ 1.9.8.7

    WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2024-11205subscriber+≤ 1.9.2.1

    WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

    Medium 6.5

  • CVE-2026-88996unauthenticated · needs a click≤ 2.0.2

    WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

    Medium 6.1

  • CVE-2023-30500unauthenticated · needs a click≤ 1.8.1.2

    WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2020-10385login required

    A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

    Medium 5.4

  • CVE-2025-3794contributor+≤ 1.9.5

    WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

    Medium 5.4

  • CVE-2024-13403contributor+≤ 1.9.3.1

    WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

    Medium 5.4

  • CVE-2026-12127unauthenticated≤ 1.10.2

    WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

    Medium 5.3

  • CVE-2026-7792unauthenticated≤ 1.10.0.4

    WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

    Medium 5.3

  • CVE-2024-3649unauthenticated≤ 1.8.7.2

    Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

    Medium 5.3

  • CVE-2020-36919unauthenticated · needs a click≤ 1.7.8

    WPForms 1.7.8 - Cross-Site Scripting (XSS)

    Medium 5.1

  • CVE-2026-15782contributor+≤ 2.0.0.1

    WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

    Medium 4.9

  • CVE-2024-10593unauthenticated · needs a click≤ 1.9.1.6

    WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

    Medium 4.3

  • CVE-2026-32446login required≤ 1.9.9.3

    WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory