CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — Unauthenticated Arbitrary File Write via Chunked Upload Proof-of-Concept Exploit Chunked Upload Init/Finalize Ordering → Predictable Path...

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload

WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpformsuploadchunkinit, wpformsuploadchunk and wpformsfilechunksuploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under...

CVE-2026-127206

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kccaptcha=kchuman to pass...

CVE-2026-127206

The Image CAPTCHA for Contact Form 7 and WPForms plugin (versions through 3.3.29 ) is vulnerable to a CAPTCHA bypass via the Contact Form 7 integration. The root cause is a hardcoded static answer within the cf7ic_check_if_spam() function. Unauthenticated attackers can defeat anti-automation cont...

EUVD-2026-124679

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kccaptcha=kchuman to pass...

CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? GoDAM WordPress plugin versions = 1.12.2 register a WPForms field called godamrecord. The upload handler savevideofile is hooked into the public...

PT-2026-146056

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc captcha=kc human to pa...

CVE-2026-127206: hookandhook Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR): Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows…

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kccaptcha=kchuman to pass...

wpforms-xss-fix-bypass

WPForms ≤ 2.0.2.1 — Bypass of the CVE-2026-88996 Fix Unauthenticated Reflected XSS Affected: WPForms – AI Form Builder for WordPress free/lite, version 2.0.2.1 — the current latest at time of disclosure also the version that contains the fix for CVE-2026-88996. The Pro edition shares the Smart Ta...

CVE-2026-54851

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3...

EUVD-2026-116764

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3...

CVE-2026-54851

The Awesomemotive Contact Form by WPForms (wpforms-lite) WordPress plugin is vulnerable to a Reflected Cross-site Scripting (XSS) flaw. This issue is caused by improper neutralization of input during web page generation. The vulnerability affects versions from the initial release through 2.0.3 . ...

CVE-2026-54851 WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3...

WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin Contact Form by WPForms versions = 2.0.3...

WordPress WPForms Lite plugin 1.10.0.1-2.0.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdulrhman Mari d7mr4ny in WordPress Plugin Contact Form by WPForms versions 1.10.0.1-2.0.2.1...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844

The WPForms Lite WordPress plugin (versions 1.10.0.1 - 2.0.2.1 ) contains a vulnerability where it fails to perform server-side verification of completed payments when using the PayPal Commerce gateway . This allows unauthenticated visitors to submit paid forms without making an actual payment. C...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

EUVD-2026-100976

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...