Vulnerabilities and security researches forweforms weforms
Direction: descendingweForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2026-111833
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Oct 21, 2026
- Research Description
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
- Affected versions
-
max 1.6.29.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2026-110253
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Oct 17, 2026
- Research Description
- The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.
- Affected versions
-
max 1.6.29.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # 7431ce6590261438ff8d83691d0148a5de295091
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Jun 25, 2024
- Research Description
- weForms – Easy Drag & Drop Contact Form Builder For WordPress [weforms] < 1.6.24 Various Plugins <= Various Version - Use of Polyfill.io Multiple plugins for WordPress are vulnerable to malicious redirection in various versions. This is due to the use of Polyfill.io. Polyfill.io is a JavaScript library used to streamline delivery of content across older browsers and was taken over by malicious threat actors that used the service to redirect victims to malicious websites. While many WordPress plugins utilize Polyfill.io, not all of them may have been delivering malicious content. Regardless, it is recommended to update to a version of the plugin where Polyfill is no longer used or manually remove the use of Polyfill.io from the plugin.
- Affected versions
-
max 1.6.24.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # 58c9b317cec22220b670fe062ccf238171668aa6
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Jul 03, 2024
- Research Description
- weForms – Easy Drag & Drop Contact Form Builder For WordPress [weforms] < 1.6.24 WordPress weForms Plugin <= 1.6.23 is vulnerable to Backdoor <p>WordPress weForms Plugin <= 1.6.23 is vulnerable to Backdoor</p><p>Software: weForms</p><p>Link: https://wordpress.org/plugins/weforms/#developers</p><p>Affected Version <= 1.6.23</p>
- Affected versions
-
max 1.6.24.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2026-2707
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Mar 11, 2026
- Research Description
- The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping.
- Affected versions
-
max 1.6.28.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2026-32484
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Mar 25, 2026
- Research Description
- Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
- Affected versions
-
max 1.6.27.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2025-69028
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Dec 30, 2025
- Research Description
- Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.
- Affected versions
-
max 1.6.26.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2023-51524
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Jun 12, 2024
- Research Description
- Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
- Affected versions
-
max 1.6.19.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2024-32512
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- May 17, 2024
- Research Description
- Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.
- Affected versions
-
max 1.6.21.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2024-0386
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Mar 13, 2024
- Research Description
- The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 1.6.22.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2024-30512
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Jun 09, 2024
- Research Description
- Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.
- Affected versions
-
max 1.6.21.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2022-2395
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Aug 08, 2022
- Research Description
- The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Affected versions
-
max 1.6.14.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2020-22276
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Nov 04, 2020
- Research Description
- WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
- Affected versions
-
max 1.6.4.
- Status
-
vulnerable
weForms – Easy Drag & Drop Contact Form Builder For WordPress # CVE-2023-50896
- CVE, Research URL
- Home page URL
-
Security reports for weForms – Easy Drag & Drop Contact Form Builder For WordPress
- Date
- Dec 29, 2023
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS.This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress: from n/a through 1.6.17.
- Affected versions
-
max 1.6.18.
- Status
-
vulnerable