Known vulnerabilities in the WPForms plugin

21 security advisories have been published for the WPForms plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.

WPForms - PHP Object Injection (CVE-2026-9691) CRITICAL 2026-06-15
WPForms - PHP Object Injection (CVE-2026-49765) CRITICAL 2026-06-15
WPForms - PHP Object Injection (CVE-2026-49109) CRITICAL 2026-06-15
WPForms - PHP Object Injection (CVE-2026-49105) CRITICAL 2026-06-15
WPForms - PHP Object Injection (CVE-2026-49104) CRITICAL 2026-06-15
WPForms - PHP Object Injection (CVE-2026-49085) CRITICAL 2026-06-15
WPForms - Broken Access Control (CVE-2026-48835) HIGH 2026-06-15
WPForms - Broken Access Control (CVE-2026-39594) MEDIUM 2026-06-15
Wpforms - Security Vulnerability (CVE-2026-4986) MEDIUM 2026-06-09
WPForms - SQL Injection (CVE-2026-42742) HIGH 2026-05-12
WPForms - Cross-Site Request Forgery (CSRF) (CVE-2026-40764) HIGH 2026-04-15
WPForms - Broken Access Control (CVE-2026-32527) MEDIUM 2026-03-25
WPForms - Broken Access Control (CVE-2026-25430) MEDIUM 2026-03-25
WPForms - Information Disclosure (CVE-2026-25339) MEDIUM 2026-03-25
WPForms - Broken Access Control (CVE-2026-32446) MEDIUM 2026-03-13
Wpforms - Cross-Site Scripting (XSS) (CVE-2024-13403) MEDIUM 2025-02-04
Wpforms - Cross-Site Scripting (XSS) (CVE-2024-11223) MEDIUM 2024-12-26
Wpforms - Broken Access Control (CVE-2024-11205) HIGH 2024-12-10
Wpforms - Cross-Site Scripting (XSS) (CVE-2024-7056) LOW 2024-11-25
Wpforms - Cross-Site Request Forgery (CSRF) (CVE-2024-10593) MEDIUM 2024-11-13
Wpforms - Cross-Site Scripting (XSS) (CVE-2023-7063) HIGH 2024-01-20

Browse the full threat database

WordPress security that blocks attacks before they land.

sales@hackhalt.com

© Hack Halt Inc. All rights reserved.