WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload

WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpformsuploadchunkinit, wpformsuploadchunk and wpformsfilechunksuploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under...

CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — Unauthenticated Arbitrary File Write via Chunked Upload Proof-of-Concept Exploit Chunked Upload Init/Finalize Ordering → Predictable Path...

CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? GoDAM WordPress plugin versions = 1.12.2 register a WPForms field called godamrecord. The upload handler savevideofile is hooked into the public...

WordPress WPForms Lite plugin 1.10.0.1-2.0.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdulrhman Mari d7mr4ny in WordPress Plugin Contact Form by WPForms versions 1.10.0.1-2.0.2.1...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844 WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844

The WPForms Lite WordPress plugin (versions 1.10.0.1 - 2.0.2.1 ) contains a vulnerability where it fails to perform server-side verification of completed payments when using the PayPal Commerce gateway . This allows unauthenticated visitors to submit paid forms without making an actual payment. C...

EUVD-2026-100976

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-82844: Insufficient Verification of Data Authenticity

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

VulnCheck KEV: CVE-2026-10818

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-84259

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84252

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84259 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96758

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84259

The click5 CRM add-on for the WPForms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored XSS . The root cause is a failure to sanitize and escape content submitted via an unauthenticated endpoint before it is displayed on an admin page. This flaw allows an attacker to execute mali...

EUVD-2026-96754

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84252

The click5 CRM add-on to WPForms WordPress plugin (versions through 1.0.3 ) is vulnerable to an unauthenticated arbitrary options update . The flaw stems from a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the updated opt...

CVE-2026-84252 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84252: Missing Authorization

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...