Unknown Forms vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Forms, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2026-86799unknownforms
EPSS score
0.38%
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.5.5CVE-2021-24505madeitforms+2
EPSS score
0.62%
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.