CVE Browser

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

WPForms 1.7.8 - Cross-Site Scripting (XSS)

Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

WPForms < 1.9.2.3 - Admin+ Stored XSS

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

WPForms < 1.9.1.6 - Admin+ Stored XSS

WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3…

WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page

WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

WPForms Pro < 1.7.7 - CSV Injection

A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.