WS Form vulnerabilities

Products

• WS Form Pro 4
• WS Form LITE – Drag & Drop Contact Form Builder for WordPress 3

Latest WS Form CVEs

Newest publication first

1. CVE-2024-13509 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting

   Published 2025-01-28

   Medium·CVSS 6.1 EPSS 0.37%

   The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

2. CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

   Published 2024-06-07

   High·CVSS 8.8 EPSS 0.49%

   The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on...

3. CVE-2023-52135 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection

   Published 2023-12-29

   High·CVSS 7.2 EPSS 0.48%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.

4. CVE-2022-23988 WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting

   Published 2022-02-28

   Medium·CVSS 6.1 EPSS 2.2%

   The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

5. CVE-2022-23987 WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

   Published 2022-02-28

   Medium·CVSS 4.8 EPSS 0.60%

   The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.