Cognito Forms
Cognito Forms has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Cognito Forms has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Cognito Forms is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-10182Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Read the full analysisVulnerability Records

Cognito Forms
Author
Cognito Forms
Cognito Forms is an easy-to-use online form builder that enables you to create everything from simple surveys to complex registration forms – no code required. Whether you’re using a pre-made template or starting from scratch, you can create forms to help your organization in just a matter of minutes. New to Cognito Forms? Watch a quick tutorial to get acquainted with the form builder, and learn how to create your first form! Features Data Collection Format numbers for calculations, dates and times, add values to dropdowns and checkboxes, capture electronic signatures, and collect file uploads using our drag-and-drop form builder. Data Management Creating your form and sharing it with your customers is just step one – what happens to all that data after it gets submitted? In Cognito Forms, you can sort through and filter down your entries, create customized data sets, and perform multiple tasks at once. Integrations Use Zapier, Microsoft Power Automate or Make to exchange data with thousands of applications. Create workflows and automatically trigger tasks directly from your form entries. And quickly set it all up using either no-code visual interfaces or JSON. Logic & Automation Set form behaviors and automate tasks using our visual conditional logic. Easily add text piping to make your forms more conversational. Or, enable actions that conditionally send notifications, include file attachments, perform calculations, or set limits in quantities and dates – all using our no-code/low-code visual interface. Security & Compliance Quickly create additional protections for fields and forms. Set organizational controls by the individual form or folder. Manage access and account permissions. And stay compliant with HIPAA, GDPR, CCPA and other security regulations. Online Payment Accept online payments directly through your forms – using Square, Stripe or PayPal. Whether you’re collecting a simple online donation or processing complex multi-variable transactions, you can do so easily on any of our plan levels.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C