Wpforms vulnerabilities

17 vulnerabilities

Known vulnerabilities in Wpforms products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.

Products

6
6.1MediumCVE-2020-36919syed balkhi · wpforms +1 moreWPForms 1.7.8 - Cross-Site Scripting (XSS)WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.EPSS0.38%6.4MediumCVE-2020-10385wordpress · wpforms-lite +1 morewordpress wpforms-liteA stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.EPSS4.43%9.8CriticalCVE-2022-3574unknown · wpforms pro +2 moreWPForms Pro < 1.7.7 - CSV InjectionThe WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.EPSS1.44%6.4MediumCVE-2024-13403smub · wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more +2 moreWPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML ParameterThe WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.39%6.1MediumCVE-2024-11272unknown · contact form & smtp plugin for wordpress by pirateforms +2 moreContact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSSThe Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.28%8.5HighCVE-2024-11205smub · wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more +2 moreWPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription CancellationThe WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.EPSS0.73%6.1MediumCVE-2024-11273unknown · contact form & smtp plugin for wordpress by pirateforms +2 moreContact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSSThe Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.28%4.7MediumCVE-2024-11223unknown · wpforms +2 moreWPForms < 1.9.2.3 - Admin+ Stored XSSThe WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.52%4.4MediumCVE-2024-7056unknown · wpforms +2 moreWPForms < 1.9.1.6 - Admin+ Stored XSSThe WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.47%8.8HighCVE-2024-56276syed balkhi · contact form by wpforms +2 moreWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.EPSS0.40%4.3MediumCVE-2024-10593smub · wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more +2 moreWPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log DeletionThe WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This makes it possible for unauthenticated attackers to delete WPForm logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.27%7.2HighCVE-2019-25145smub · contact form & smtp plugin for wordpress by pirateforms +2 moreContact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injectionThe Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.EPSS0.66%7.2HighCVE-2026-18409wordpress · wpforms +1 moreWPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field ValuesThe WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.EPSS0.34%8.1HighCVE-2026-10818wordpress · wpforms +1 moreWPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize OrderingThe WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.EPSS2.48%7.2HighCVE-2023-7063wordpress · wpforms +2 morewordpress wpformsThe WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.53%6.1MediumCVE-2023-30500wordpress · wpforms +5 moreWordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerabilityUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.EPSS0.40%5.3MediumCVE-2023-3213wordpress · wp-mail-smtp-pro +2 moreWP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_pageThe WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.EPSS0.51%