WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

Güvenlik açıkları

• CVE-2024-56276giriş gerekir≤ 1.9.2.2

  WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

  Yüksek 8.8

• CVE-2026-40764kimlik doğrulamasız · tıklama gerekir≤ 1.10.0.2

  WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

  Yüksek 8.1

• CVE-2026-48835kimlik doğrulamasız≤ 1.10.0.4

  WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

  Yüksek 7.5

• CVE-2026-25339kimlik doğrulamasız · tıklama gerekir≤ 1.9.8.7

  WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

  Orta 6.5

• CVE-2024-11205abone+≤ 1.9.2.1

  WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

  Orta 6.5

• CVE-2026-88996kimlik doğrulamasız · tıklama gerekir≤ 2.0.2

  WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

  Orta 6.1

• CVE-2023-30500kimlik doğrulamasız · tıklama gerekir≤ 1.8.1.2

  WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2020-10385giriş gerekir

  A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

  Orta 5.4

• CVE-2025-3794katılımcı+≤ 1.9.5

  WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

  Orta 5.4

• CVE-2024-13403katılımcı+≤ 1.9.3.1

  WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

  Orta 5.4

• CVE-2026-12127kimlik doğrulamasız≤ 1.10.2

  WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

  Orta 5.3

• CVE-2026-7792kimlik doğrulamasız≤ 1.10.0.4

  WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

  Orta 5.3

• CVE-2024-3649kimlik doğrulamasız≤ 1.8.7.2

  Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

  Orta 5.3

• CVE-2020-36919kimlik doğrulamasız · tıklama gerekir≤ 1.7.8

  WPForms 1.7.8 - Cross-Site Scripting (XSS)

  Orta 5.1

• CVE-2026-15782katılımcı+≤ 2.0.0.1

  WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

  Orta 4.9

• CVE-2024-10593kimlik doğrulamasız · tıklama gerekir≤ 1.9.1.6

  WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

  Orta 4.3

• CVE-2026-32446giriş gerekir≤ 1.9.9.3

  WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

  Orta 4.3