WPForms Pro

WPForms Pro has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Improper Neutralization Of Formula Elements In A CSV File, Unrestricted Upload Of File With Dangerous Type.

Every one of the 5 issues recorded for WPForms Pro has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WPForms Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-10818

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

Read the full analysis

Vulnerability Records

5 records


2026-08-20 14:47	WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values WPForms Pro <= 2.0.0.2	`CVE-2026-18409`	7.2 High	daroo	Yes
2026-07-24 17:42	WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering WPForms Pro <= 1.10.1.1	`CVE-2026-10818`	8.1 High	lhking	Yes
2024-01-19 00:00	WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission WPForms Pro 1.8.4 – 1.8.5.3	`CVE-2023-7063`	7.2 High	drop	Yes
2023-06-20 00:00	Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting WPForms Pro <= 1.8.1.2	`CVE-2023-30500`	6.1 Medium	Rafie Muhammad	Yes
2022-10-19 00:00	WPForms Pro <= 1.7.6 - CSV Injection WPForms Pro <= 1.7.6	`CVE-2022-3574`	7.2 High	Francesco Carlucci	Yes

Showing 1–5 of 5 reports