CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — Unauthenticated Arbitrary File Write via Chunked Upload Proof-of-Concept Exploit Chunked Upload Init/Finalize Ordering → Predictable Path...

WordPress WPForms Pro plugin has a cross-site scripting vulnerability

The WordPress WPForms Pro plugin is one of the most popular paid versions of form plugins on WordPress. The WPForms Pro plugin has a cross-site scripting vulnerability, which stems from insufficient input cleaning and output escaping for values of the Single Line Text and Paragraph Text Fields. N...

WordPress WPForms Pro plugin <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability discovered by daroo in WordPress Plugin WPForms Pro versions = 2.0.0.2...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409

WPForms Pro for WordPress (all versions ≤ 2.0.0.2 ) is vulnerable to unauthenticated Stored XSS via Single Line Text and Paragraph Text Field values. The root cause is the plugin's own wp_kses_allowed_html filter, which widens the 'post' allowlist to permit iframe elements with a data-src attribu...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409: Improper Neutralization of Input During Web Page Generation

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-79293

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Exploit for CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Ar...

CVE-2026-10818

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818

WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...

CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818: Unrestricted Upload of File with Dangerous Type

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

EUVD-2022-42938

Malicious code in bioql PyPI...

EUVD-2023-34915

Malicious code in bioql PyPI...

CVE-2023-30500

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPForms WPForms Lite wpforms-lite, WPForms WPForms Pro wpforms plugins = 1.8.1.2 versions...

CVE-2022-3574

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection...

WordPress WPForms Pro Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Pro Type Plugin Vulnerable versions = 1.8.5.3 Fixed in 1.8.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7063 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b002ca3b6fb7 Credits drop Required...