Unknown Wpforms vulnerabilities

3 CVEs affecting Unknown Wpforms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84744, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-4986, published 2026-06-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads…
CVE-2026-84744, published 2026-09-28. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated…
CVE-2026-74991, published 2026-09-24. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to…