WPForms Pro vulnerabilities

2 known vulnerabilities in WPForms Pro from WPForms. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  WPForms Pro: Improper Neutralization of Input During Web Page Generation

  CVE-2026-18409Aug 21, 2026WPForms

  The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possi

• 8.1 High severity

  WPForms Pro: Unrestricted Upload of File with Dangerous Type

  CVE-2026-10818Jul 25, 2026WPFormsEPSS 2.48%

  The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents hav