Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-101921

WPForms <= 2.0.2.1 - Cross-Site Scripting reflejado mediante etiqueta inteligente 'query_var' en atributo iframe srcdoc

Una vulnerabilidad de cross-site scripting reflejado en WPForms permite a atacantes no autenticados ejecutar scripts mediante enlaces maliciosos bajo configuraciones específicas de formularios.

WordPress

wpforms-lite

Media 24.09.2026

CVE-2026-88996

WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

WordPress

wpforms-lite

Media 24.09.2026

CVE-2026-84744

WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution

WordPress

wpforms-lite

Media 22.09.2026

CVE-2026-74991

WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization

WordPress

wpforms-lite

Media 20.07.2026

CVE-2026-15782

WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

WordPress

wpforms-lite

Media 30.06.2026

CVE-2026-12127

WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

WordPress

wpforms-lite

Media 05.06.2026

CVE-2026-7792

WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

WordPress

wpforms-lite

Media 28.05.2026

CVE-2026-42742

Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection

WordPress

views-for-wpforms-lite

Media 28.05.2026

CVE-2026-48835

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization

WordPress

wpforms-lite

Media 19.05.2026

CVE-2026-4986

WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass

WordPress

wpforms-lite

Media 31.03.2026

CVE-2026-40764

Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery

WordPress

wpforms-lite

Media 23.03.2026

CVE-2026-25339

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure

WordPress

wpforms-lite

Media 07.03.2026

CVE-2026-32446

Contact Form by WPForms <= 1.9.9.3 - Missing Authorization

WordPress

wpforms-lite

Media 09.05.2025

CVE-2025-3794

WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

WordPress

wpforms-lite

Media 03.02.2025

CVE-2024-13403

WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

WordPress

wpforms-lite

Media 03.01.2025

CVE-2024-56276

Contact Form by WPForms <= 1.9.2.2 - Missing Authorization

WordPress

wpforms-lite

Alta 09.12.2024

CVE-2024-11205

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

WordPress

wpforms-lite

Media 05.12.2024

CVE-2024-11223

WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

WordPress

wpforms-lite

Media 12.11.2024

CVE-2024-10593

WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

WordPress

wpforms-lite

Media 04.11.2024

CVE-2024-7056

WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

WordPress

wpforms-lite

Media 01.05.2024

CVE-2024-3649

Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

WordPress

wpforms-lite

Media 24.01.2024

CVE-2024-0373

Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view

WordPress

views-for-wpforms-lite

Media 24.01.2024

CVE-2024-0371

Views for WPForms <= 3.2.2 - Missing Authorization via create_view

WordPress

views-for-wpforms-lite

Media 24.01.2024

CVE-2024-0370

Views for WPForms <= 3.2.2 - Missing Authorization via save_view

WordPress

views-for-wpforms-lite