Advisories · Technology

WPForms Pro.

Every CVE that names WPForms Pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-18409 CVE record

CVSS 7.2 High

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
- WPForms Pro
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-10818 CVE record

CVSS 8.1 High

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
- WPForms Pro
- Unrestricted file upload
Not analysed yet 25 Jul 2026
CVE-2023-7063 CVE record

CVSS 7.2 High

Cross-site scripting in WPForms Pro
- WPForms Pro
- Cross-site scripting (XSS)
Not analysed yet 20 Jan 2024
CVE-2023-30500 CVE record

CVSS 5.8 Medium

WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability
- WPForms Lite
- WPForms Pro
- Cross-site scripting (XSS)
Not analysed yet 22 Jun 2023
CVE-2022-3574 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WPForms Pro < 1.7.7 - CSV Injection
- WPForms Pro
- Other injection
Not analysed yet 14 Nov 2022