WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

Уязвимости

• CVE-2024-56276нужен вход≤ 1.9.2.2

  WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2026-40764без авторизации · нужен клик≤ 1.10.0.2

  WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.1

• CVE-2026-48835без авторизации≤ 1.10.0.4

  WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2026-25339без авторизации · нужен клик≤ 1.9.8.7

  WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

  Средний 6.5

• CVE-2024-11205подписчик+≤ 1.9.2.1

  WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

  Средний 6.5

• CVE-2026-88996без авторизации · нужен клик≤ 2.0.2

  WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

  Средний 6.1

• CVE-2023-30500без авторизации · нужен клик≤ 1.8.1.2

  WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2020-10385нужен вход

  A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

  Средний 5.4

• CVE-2025-3794участник+≤ 1.9.5

  WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

  Средний 5.4

• CVE-2024-13403участник+≤ 1.9.3.1

  WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

  Средний 5.4

• CVE-2026-12127без авторизации≤ 1.10.2

  WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

  Средний 5.3

• CVE-2026-7792без авторизации≤ 1.10.0.4

  WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

  Средний 5.3

• CVE-2024-3649без авторизации≤ 1.8.7.2

  Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

  Средний 5.3

• CVE-2020-36919без авторизации · нужен клик≤ 1.7.8

  WPForms 1.7.8 - Cross-Site Scripting (XSS)

  Средний 5.1

• CVE-2026-15782участник+≤ 2.0.0.1

  WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

  Средний 4.9

• CVE-2024-10593без авторизации · нужен клик≤ 1.9.1.6

  WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

  Средний 4.3

• CVE-2026-32446нужен вход≤ 1.9.9.3

  WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

  Средний 4.3