WPForms vulnerabilities
We track 4 vulnerabilities in WPForms products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest WPForms vulnerabilities
- 7.2 High severity
WPForms Pro: Improper Neutralization of Input During Web Page Generation
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possi
- 8.1 High severity
WPForms Pro: Unrestricted Upload of File with Dangerous Type
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents hav
- 8.8 High severity
Contact Form by WPForms: Missing Authorization
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
- 8.0 High severity
WPForms User Registration: Improper Privilege Management
Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration: from n/a through 2.1.0.