Google Forms

Google Forms has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2022; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2018 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Code Injection, Deserialization Of Untrusted Data.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2022.

3 independent researchers contributed these findings, most of them (2) reported by Yorick Koster,.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Google Forms vulnerabilities before they are exploited.

Most severe open issueCVSS 5.5CVE-2022-3834

Google Forms <= 0.95 - Authenticated (Admin+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

5 records


2022-11-03 00:00	Google Forms <= 0.95 - Authenticated (Admin+) Stored Cross-Site Scripting Google Forms <= 0.95	`CVE-2022-3834`	5.5 Medium	zhangyunpei	No
2018-05-08 00:00	Google Forms <= 0.93 - Remote Code Execution Google Forms < 0.94	`CVE-2018-20988`	7.5 High	Anonymous	Yes
2018-01-20 00:00	Google Forms < 0.92 - Unauthenticated Server Side Request Forgery Google Forms < 0.92	`N/A`	7.2 High	Klikki Oy	Yes
2017-01-07 00:00	Google Forms <= 0.90 - Unauthenticated PHP Object injection Google Forms < 0.91	`N/A`	9.8 Critical	Yorick Koster,	Yes
2016-07-14 00:00	Google Forms < 0.85 - Cross-Site Scripting Google Forms < 0.85	`N/A`	6.1 Medium	Yorick Koster,	Yes

Showing 1–5 of 5 reports