Contact Form by WPForms

Syed Balkhi

Developer

2.0.2.2

Latest version

5,000,000

Installations

No date

Last updated

WordPress Plugin

No VDP

Claim ownership

Report vulnerability

Vulnerabilities

Security Contributors

Vulnerability history

0 present

25 patched

3 Mitigation rules

Unauthenticated Arbitrary Shortcode Execution vulnerability
1.5.0.1-2.0.2.0
28/09/2026
Reflected Cross-Site Scripting vulnerability
<= 2.0.2
25/09/2026
Unauthenticated Stripe Refund and Subscription Cancellation vulnerability
1.8.8.2-2.0.1
25/09/2026
Unauthenticated PayPal Webhook Forgery vulnerability
< 1.10.0.5
17/09/2026
Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
<= 2.0.0.1
20/07/2026
Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection vulnerability
<= 1.10.2
30/06/2026
Unauthenticated Insufficient Verification of Data Authenticity vulnerability
<= 1.10.0.4
05/06/2026
Broken Access Control vulnerability
<= 1.10.0.4
28/05/2026
Cross Site Request Forgery (CSRF) vulnerability
<= 1.10.0.2
31/03/2026
Sensitive Data Exposure vulnerability
<= 1.9.8.7
23/03/2026
Broken Access Control vulnerability
<= 1.9.9.3
07/03/2026
Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter vulnerability
<= 1.9.5
09/05/2025
Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter vulnerability
<= 1.9.3.1
03/02/2025
Broken Access Control vulnerability
<= 1.9.2.2
03/01/2025
Admin+ Stored XSS vulnerability
< 1.9.2.3
26/12/2024
Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation vulnerability
1.8.4-1.9.2.1
09/12/2024
Admin+ Stored XSS vulnerability
< 1.9.1.6
25/11/2024
Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion vulnerability
<= 1.9.1.6
12/11/2024
Unauthenticated Price Manipulation vulnerability
<= 1.8.7.2
02/05/2024
Reflected Cross Site Scripting (XSS) vulnerability
<= 1.8.1.2
20/06/2023
Authenticated Arbitrary File Access vulnerability
<= 1.7.5.3
19/09/2022
Authenticated Stored Cross-Site Scripting (XSS) vulnerability
<= 1.6.0.1
01/07/2020
Authenticated Cross-Site Scripting (XSS) vulnerability
<= 1.5.8.2
05/03/2020
Unauthenticated Cross-Site Scripting (XSS) vulnerability
<= 1.4.8
10/12/2018
Authenticated Stored Cross-Site Scripting (XSS) vulnerability
<= 1.4.7
07/12/2018