WordPress Database Addon For WPForms ( wpforms entries ) plugin < 1.1.1 - Arbitrary Form Entry Deletion vulnerability

Arbitrary Form Entry Deletion vulnerability discovered by Rik de Kok in WordPress Plugin Database Addon For WPForms wpforms entries versions 1.1.1...

PT-2026-107838

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

WordPress WPForms plugin 1.5.0.1-2.0.2.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Contact Form by WPForms versions 1.5.0.1-2.0.2.0...

CVE-2026-84744

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

EUVD-2026-88098

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744

The WPForms Lite WordPress plugin (versions 1.5.0.1 to 2.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcode delimiters from submitted field values before repopulating them into the rendered form. This flaw allows an unauthentic...

PT-2026-99773

Name of the Vulnerable Software and Affected Versions WPForms Lite versions 1.5.0.1 through 2.0.2 Description The plugin fails to remove shortcode delimiters from submitted field values before they are written back into the rendered form. This allows unauthenticated users to execute arbitrary...

CVE-2026-84744: Improper Control of Generation of Code

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2...

WordPress WPForms plugin 1.8.8.2-2.0.1 - Unauthenticated Stripe Refund and Subscription Cancellation vulnerability

Unauthenticated Stripe Refund and Subscription Cancellation vulnerability discovered by Charles Vosburgh in WordPress Plugin Contact Form by WPForms versions 1.8.8.2-2.0.1...

EUVD-2026-86590

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.0.2 . The root cause is insufficient input sanitization and output escaping of the page_title POST parameter when processed via the {page_title} Smart Tag...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

VulnCheck KEV: CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

PT-2026-98387

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

CVE-2026-88996: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...