Unknown WPForms

• CVE-2026-84744 Medium 6.5 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation 0.2%
• CVE-2026-74991 Medium 6.8 WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent 0.2%
• CVE-2026-4986 Medium 5.3 WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery 0.2%
• CVE-2024-11223 Medium 4.7 WPForms < 1.9.2.3 - Admin+ Stored XSS 0.5%
• CVE-2024-7056 Low 3.5 WPForms < 1.9.1.6 - Admin+ Stored XSS 0.4%