Unknown Wpforms vulnerabilities

5 vulnerabilities

Known vulnerabilities in Unknown Wpforms, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.7MediumCVE-2024-11223unknown · wpforms +2 moreWPForms < 1.9.2.3 - Admin+ Stored XSSThe WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.52%4.4MediumCVE-2024-7056unknown · wpforms +2 moreWPForms < 1.9.1.6 - Admin+ Stored XSSThe WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.47%6.8MediumCVE-2026-74991unknown · wpforms +1 moreWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntentThe WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.EPSS0.18%6.5MediumCVE-2026-84744unknown · wpforms +1 moreWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationThe WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.EPSS0.18%5.3MediumCVE-2026-4986unknown · wpforms +1 moreWPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook ForgeryThe WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.EPSS0.33%