WPForms
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 29 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 11, 2020 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability
WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability
WPForms 1.7.8 - Cross-Site Scripting (XSS)
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload
Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
Monitor WPForms in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.