Unknown Wpforms vulnerabilities

• unknown wpforms lite, wpforms lite +1 more WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce CVE-2026-82844 5.3 MediumOctober 14, 2026
• unknown click5 crm add-on to wpforms click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications CVE-2026-84259 8.8 HighOctober 11, 2026
• unknown click5 crm add-on to wpforms click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE-2026-84252 9.8 CriticalOctober 11, 2026
• unknown database addon for wpforms ( wpforms entries ) Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF CVE-2026-105260 4.3 MediumOctober 8, 2026
• syed balkhi wpforms WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation CVE-2026-84744 6.5 MediumSeptember 28, 2026
• syed balkhi wpforms WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent CVE-2026-74991 6.8 MediumSeptember 24, 2026
• crmperks database for contact form 7, wpforms, elementor forms Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter CVE-2026-14872 6.8 MediumAugust 4, 2026
• crmperks database for contact form 7, wpforms, elementor forms Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id CVE-2026-14870 7.1 HighJuly 28, 2026
• crmperks database for contact form 7, wpforms, elementor forms Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field CVE-2026-12081 5.0 MediumJuly 13, 2026
• syed balkhi wpforms WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery CVE-2026-4986 5.3 MediumJune 9, 2026
• syed balkhi wpforms WPForms < 1.9.2.3 - Admin+ Stored XSS CVE-2024-11223 4.7 MediumDecember 26, 2024
• syed balkhi wpforms WPForms < 1.9.1.6 - Admin+ Stored XSS CVE-2024-7056 3.5 LowNovember 25, 2024
• gsheetconnector wpforms google sheet connector, unknown gsheetconnector-wpforms-pro +1 more WPForms Google Sheet Connector < 3.4.6 - Reflected XSS CVE-2023-2321 6.1 MediumJuly 4, 2023
• unknown wpforms pro, wpforms pro +1 more WPForms Pro < 1.7.7 - CSV Injection CVE-2022-3574 9.8 CriticalNovember 14, 2022
• crmperks contact form entries, unknown contact form entries – contact form 7, wpforms and more +1 more Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting CVE-2021-25080 EPSS 84.2% 6.1 MediumJanuary 24, 2022
• crmperks contact form entries, unknown contact form entries – contact form 7, wpforms and more +1 more Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting CVE-2021-25079 6.1 MediumJanuary 24, 2022