WPQA - Builder forms Addon For WordPress

WPQA - Builder forms Addon For WordPress has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 10 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 8 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 4 of the records (40%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

Every one of the 10 issues recorded for WPQA - Builder forms Addon For WordPress has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (4) reported by Veshraj Ghimire.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WPQA - Builder forms Addon For WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-3688

WPQA < 5.9 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

10 records


2024-06-12 00:00	WPQA Builder <= 6.1.0 - Cross-Site Request Forgery WPQA - Builder forms Addon For WordPress <= 6.1.0	`CVE-2024-2376`	4.3 Medium	Bob Matyas	Yes
2024-06-12 00:00	WPQA - Builder forms Addon For WordPress plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting WPQA - Builder forms Addon For WordPress <= 6.1.0	`CVE-2024-2375`	6.4 Medium	Bob Matyas	Yes
2022-12-13 00:00	WPQA - Builder forms Addon For WordPress (<= 5.9.2), Himer (<= 1.9.3) and Discy (<= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference WPQA - Builder forms Addon For WordPress <= 5.9.2	`CVE-2022-3343`	4.3 Medium	Harsh Tandel	Yes
2022-10-25 00:00	WPQA < 5.9 - Cross-Site Request Forgery WPQA - Builder forms Addon For WordPress < 5.9	`CVE-2022-3688`	8.8 High	Bikram Kharal (themarkib)	Yes
2022-08-01 00:00	WPQA - Builder forms Addon For WordPress < 5.7 - Information Disclosure WPQA - Builder forms Addon For WordPress < 5.7	`CVE-2022-2198`	6.5 Medium	Bikram Kharal (themarkib)	Yes
2022-05-10 00:00	WPQA - Builder forms Addon For WordPress <= 5.4 - Unauthenticated Private Message Disclosure WPQA - Builder forms Addon For WordPress <= 5.4	`CVE-2022-1598`	5.3 Medium	Veshraj Ghimire	Yes
2022-05-10 00:00	WPQA - Builder forms Addon For WordPress <= 5.3 - Reflected Cross-Site Scripting WPQA - Builder forms Addon For WordPress < 5.4	`CVE-2022-1597`	6.1 Medium	Veshraj Ghimire	Yes
2022-04-21 00:00	WPQA - Builder forms Addon For WordPress < 5.2 - Stored Cross-Site Scripting via Profile fields WPQA - Builder forms Addon For WordPress < 5.2	`CVE-2022-1051`	5.4 Medium	Veshraj Ghimire	Yes
2022-04-21 00:00	WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Private Message Disclosure WPQA - Builder forms Addon For WordPress < 5.2	`CVE-2022-1425`	5.3 Medium	Veshraj Ghimire	Yes
2022-04-21 00:00	WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Profile Picture Deletion WPQA - Builder forms Addon For WordPress < 5.2	`CVE-2022-1349`	6.4 Medium	Binit Ghimire	Yes

Showing 1–10 of 10 reports