westguard vulnerabilities

Products

• WS Form LITE – Drag & Drop Contact Form Builder 6

Latest westguard CVEs

Newest publication first

1. CVE-2026-122231 WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value

   Published 2026-11-07

   High·CVSS 7.2 EPSS 0.45%

   The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possi...

2. CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

   Published 2026-08-22

   Critical·CVSS 9.8 EPSS 0.90%

   The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attacke...

3. CVE-2025-3912 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure

   Published 2025-04-25

   Medium·CVSS 5.3 EPSS 0.41%

   The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_config' function in all versions up to, and including, 1.10.35. This makes it possible for unauthentic...

4. CVE-2024-13509 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting

   Published 2025-01-28

   Medium·CVSS 6.1 EPSS 0.37%

   The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

5. CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL

   Published 2024-11-06

   Medium·CVSS 6.1 EPSS 0.32%

   The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it possible...

6. CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

   Published 2024-06-07

   High·CVSS 8.8 EPSS 0.49%

   The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.