Advisories · Technology
smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More.
Every CVE that names smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- CWE-345
- CVSS 5.4 Medium
WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Cross-site scripting (XSS)
- CVSS 8.5 High
WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Broken access control
- CVSS 4.3 Medium
WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- CWE-472