Wpforms
Monthly
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
Unauthenticated shortcode injection in WPForms Lite (versions 1.5.0.1 through 2.0.2) lets remote attackers execute arbitrary registered WordPress shortcodes by submitting form field values that the plugin echoes back into the rendered form without stripping shortcode delimiters. Publicly available exploit code exists via the WPScan advisory, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium) confirms low-complexity, no-user-interaction exploitation. Impact is bounded by the shortcodes present on the target; successful exploitation can disclose attachment details of non-public posts and modify rendered form output, but does not by itself grant full remote code execution.
Unauthenticated attackers can force full refunds and immediate subscription cancellations on WordPress sites running the WPForms plugin before 2.0.2 by submitting a Stripe payment object that actually belongs to a different application sharing the same Stripe account. Because the plugin never verifies that the referenced Stripe object was created by WPForms (CWE-284, improper access control), any public form submission carrying a known, valid payment or subscription identifier is acted upon directly against the site owner's Stripe account. Exploitation is remote and unauthenticated per the assessed vector (PR:N/UI:N) but is constrained by high attack complexity (AC:H): Stripe identifiers cannot be enumerated through the flaw, so an attacker must already possess a legitimate reference. Publicly available exploit code exists; no active exploitation has been confirmed (CISA SSVC Exploitation: none), and impact is limited to integrity - refunds and cancellations - with no data disclosure.
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser. [CVSS 6.1 MEDIUM]
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in WPForms Contact Form by WPForms allows Exploiting Incorrectly Configured Access Control Security Levels.9.2.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
Unauthenticated shortcode injection in WPForms Lite (versions 1.5.0.1 through 2.0.2) lets remote attackers execute arbitrary registered WordPress shortcodes by submitting form field values that the plugin echoes back into the rendered form without stripping shortcode delimiters. Publicly available exploit code exists via the WPScan advisory, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium) confirms low-complexity, no-user-interaction exploitation. Impact is bounded by the shortcodes present on the target; successful exploitation can disclose attachment details of non-public posts and modify rendered form output, but does not by itself grant full remote code execution.
Unauthenticated attackers can force full refunds and immediate subscription cancellations on WordPress sites running the WPForms plugin before 2.0.2 by submitting a Stripe payment object that actually belongs to a different application sharing the same Stripe account. Because the plugin never verifies that the referenced Stripe object was created by WPForms (CWE-284, improper access control), any public form submission carrying a known, valid payment or subscription identifier is acted upon directly against the site owner's Stripe account. Exploitation is remote and unauthenticated per the assessed vector (PR:N/UI:N) but is constrained by high attack complexity (AC:H): Stripe identifiers cannot be enumerated through the flaw, so an attacker must already possess a legitimate reference. Publicly available exploit code exists; no active exploitation has been confirmed (CISA SSVC Exploitation: none), and impact is limited to integrity - refunds and cancellations - with no data disclosure.
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser. [CVSS 6.1 MEDIUM]
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in WPForms Contact Form by WPForms allows Exploiting Incorrectly Configured Access Control Security Levels.9.2.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.