WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

Vulnerabilities 26Slug wpforms-liteLatest version 1.10.0.4WordPress.org →

Minimum safe version

1.10.0.3

Update to 1.10.0.3 or later to address 24 fixable vulnerabilities

Latest available1.10.0.4 ✓Affected up to1.9.2.1 ⚠
Medium 6.5
2026-03-25< 1.9.9.2

CVE-2026-25339

CVEWordfence
Medium 4.3
2026-03-13< 1.9.9.4

CVE-2026-32446

CVEWordfence
Medium 6.1
2026-01-13= 1.7.8

CVE-2020-36919

CVE
Medium 5.4
2025-05-09< 1.9.5.1

WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

WordfenceEUVDCVE
Medium 4.3
2025-01-07< 1.9.2.3

CVE-2024-56276

CVEWordfence
Medium 4.7
2024-12-26< 1.9.2.3

CVE-2024-11223

CVEWordfence
N/A
< 1.4.8

Contact Form by WPForms &lt; 1.4.8 - Authenticated Stored Cross-Site Scripting (XSS)

WPScan
N/A
< 1.4.8.1

Contact Form by WPForms &lt; 1.4.8.1 - Unauthenticated Cross-Site Scripting (XSS)

WPScan
N/A
< 1.6.0.2

Contact Form by WPForms &lt; 1.6.0.2 - Authenticated Stored Cross-Site Scripting (XSS)

WPScan
N/A
< 1.7.5.5

Contact Form by WPForms &lt; 1.7.5.5 - Admin+ Arbitrary File Access

WPScan
N/A
2018-09-18< 1.4.8

Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting

Wordfence
N/A
2018-12-10< 1.4.8.1

Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting

Wordfence
N/A
2020-05-21< 1.6.0.2

Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting

Wordfence
N/A
2022-09-19< 1.7.5.5

Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal

Wordfence
N/A
2022-09-19< 1.7.5.5

WordPress Contact Form by WPForms plugin <= 1.7.5.3 - Authenticated Arbitrary File Access vulnerability

Patchstack
N/A
2018-12-07< 1.4.8

WordPress Contact Form by WPForms plugin <= 1.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2018-12-10< 1.4.8.1

WordPress Contact Form by WPForms plugin <= 1.4.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2020-07-01< 1.6.0.2

WordPress Contact Form by WPForms plugin <= 1.6.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Patchstack