boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Latest boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress vulnerabilities

CVE-2026-110253 — weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter (CVSS 5.4)
CVE-2026-2707 — weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API (CVSS 6.4)
CVE-2023-51524 — WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerability (CVSS 8.8)
CVE-2024-30512 — WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability (CVSS 9.1)
CVE-2024-32512 — WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability (CVSS 5.3)
CVE-2024-0386 — weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer (CVSS 6.1)
CVE-2023-50896 — WordPress weForms Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
CVE-2022-2395 — weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
CVE-2020-22276 — (CVSS 9.8)