WPForms WPForms Pro

• CVE-2026-18409 High 7.2 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values 0.3%
• CVE-2026-10818 High 8.1 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering 2.5%
• CVE-2023-7063 High 7.2 The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization an 0.5%
• CVE-2023-30500 Medium 5.8 WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability 0.4%