WPForms
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 33 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 11, 2020 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability
WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability
Monitor WPForms in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.