Advisories · Technology
WPForms.
Every CVE that names WPForms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
- WPForms
- Code injection
- CVSS 6.8 Medium
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
- WPForms
- Broken access control
- CVSS 5.3 Medium
WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
- WPForms
- Broken access control
- CVSS 4.7 Medium
WPForms < 1.9.2.3 - Admin+ Stored XSS
- WPForms
- CVSS 3.5 Low
WPForms < 1.9.1.6 - Admin+ Stored XSS
- WPForms