WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

Information

Software Type Plugin
Software Slug wpforms-lite (view on wordpress.org)
Software Status Active
Software Author smub
Software Website wpforms.com
Software Downloads 339,738,799
Software Active Installs 5,000,000
Software Record Last Updated July 15, 2026

20 Vulnerabilities

Submit a Vulnerability
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
5.3
CVE-2026-12127
Jun 30, 2026
Researcher: Jack Pas (Dark.)
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
5.3
CVE-2026-7792
Jun 5, 2026
Researcher: Valatty
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization
5.3
CVE-2026-48835
May 28, 2026
Researcher: Cyrille COQUARD
Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery
4.3
CVE-2026-40764
Mar 31, 2026
Researcher: vladimir tokarev
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2026-25339
Mar 23, 2026
Researcher: Sandeep V
Contact Form by WPForms <= 1.9.9.3 - Missing Authorization
4.3
CVE-2026-32446
Mar 7, 2026
Researcher: davidfdzmorilla
WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
5.4
CVE-2025-3794
May 9, 2025
Researcher: Asaf Mozes
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
6.4
CVE-2024-13403
Feb 3, 2025
Researcher: Asaf Mozes
Contact Form by WPForms <= 1.9.2.2 - Missing Authorization
4.3
CVE-2024-56276
Jan 3, 2025
Researcher: Rafie Muhammad
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
8.5
CVE-2024-11205
Dec 9, 2024
Researcher: villu164
WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-11223
Dec 5, 2024
Researcher: Dmitrii Ignatyev
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
4.3
CVE-2024-10593
Nov 12, 2024
Researcher: Asaf Mozes
WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-7056
Nov 4, 2024
Researcher: Dmitrii Ignatyev
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
5.3
CVE-2024-3649
May 1, 2024
Researcher: Asaf Mozes
Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting
6.1
CVE-2023-30500
Jun 20, 2023
Researcher: Rafie Muhammad
Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal
6.8
CVE ID Unknown
Sep 19, 2022
Researcher: Sybre Waaijer
Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting
7.2
CVE ID Unknown
May 21, 2020
Researcher: Fortinet's FortiGuard Labs
Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting
6.4
CVE-2020-10385
Feb 18, 2020
Researcher: Jinson Varghese Behanan
Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting
7.1
CVE ID Unknown
Dec 10, 2018
Researcher: RIPS Technologies
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting
6.4
CVE ID Unknown
Sep 18, 2018
Researcher: RIPS Technologies
Title Status CVE ID CVSS Researchers Date
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name Patched CVE-2026-12127 5.3 Jack Pas (Dark.) June 30, 2026
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint Patched CVE-2026-7792 5.3 Valatty June 5, 2026
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization Patched CVE-2026-48835 5.3 Cyrille COQUARD May 28, 2026
Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery Patched CVE-2026-40764 4.3 vladimir tokarev March 31, 2026
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure Patched CVE-2026-25339 5.3 Sandeep V March 23, 2026
Contact Form by WPForms <= 1.9.9.3 - Missing Authorization Patched CVE-2026-32446 4.3 davidfdzmorilla March 7, 2026
WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter Patched CVE-2025-3794 5.4 Asaf Mozes May 9, 2025
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter Patched CVE-2024-13403 6.4 Asaf Mozes February 3, 2025
Contact Form by WPForms <= 1.9.2.2 - Missing Authorization Patched CVE-2024-56276 4.3 Rafie Muhammad January 3, 2025
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation Patched CVE-2024-11205 8.5 villu164 December 9, 2024
WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-11223 4.4 Dmitrii Ignatyev December 5, 2024
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion Patched CVE-2024-10593 4.3 Asaf Mozes November 12, 2024
WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-7056 4.4 Dmitrii Ignatyev November 4, 2024
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation Patched CVE-2024-3649 5.3 Asaf Mozes May 1, 2024
Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting Patched CVE-2023-30500 6.1 Rafie Muhammad June 20, 2023
Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal Patched 6.8 Sybre Waaijer September 19, 2022
Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting Patched 7.2 Fortinet's FortiGuard Labs May 21, 2020
Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting Patched CVE-2020-10385 6.4 Jinson Varghese Behanan February 18, 2020
Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting Patched 7.1 RIPS Technologies December 10, 2018
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting Patched 6.4 RIPS Technologies September 18, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation