weForms vulnerabilities

Products

• weForms 3
• weForms – Easy Drag & Drop Contact Form Builder For WordPress 1

Latest weForms CVEs

Newest publication first

1. CVE-2023-51524 WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerability

   Published 2024-06-12

   High·CVSS 8.8 EPSS 0.34%

   Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.

2. CVE-2024-30512 WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability

   Published 2024-06-09

   Critical·CVSS 9.1 EPSS 0.35%

   Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.

3. CVE-2024-32512 WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability

   Published 2024-05-17

   Medium·CVSS 5.3 EPSS 0.34%

   Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.

4. CVE-2023-50896 WordPress weForms Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-12-29

   Medium·CVSS 4.8 EPSS 0.33%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS.This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress: from n/a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.