VendorsWPFormscontact_formall versions
Vulnerabilities

WPForms Contact Form 1.5.9 for WordPress

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

4CVEs
CVE-2019-25145
Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection
Published 2023-06-07 · Modified
7.2EPSS 0.007
CVE-2023-30500
WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability
Published 2023-06-22 · Modified
6.1EPSS 0.004
CVE-2024-11273
Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS
Published 2025-03-25 · Analyzed
6.1EPSS 0.003
CVE-2020-10385
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
Published 2020-03-11 · Modified
5.41 PoCEPSS 0.044