https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-36919.htmlhttps://patchthecve.com/cve/CVE-2020-36919.htmlWed, 17 Jun 2026 03:16:30 +0000MEDIUM 6.1: WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.https://patchthecve.com/cve/CVE-2024-56276.htmlhttps://patchthecve.com/cve/CVE-2024-56276.htmlWed, 17 Jun 2026 08:11:58 +0000MEDIUM 4.3: Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.https://patchthecve.com/cve/CVE-2024-11223.htmlhttps://patchthecve.com/cve/CVE-2024-11223.htmlWed, 17 Jun 2026 06:57:18 +0000MEDIUM 4.7: The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-11205.htmlhttps://patchthecve.com/cve/CVE-2024-11205.htmlWed, 17 Jun 2026 06:57:16 +0000HIGH 8.5: The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acceshttps://patchthecve.com/cve/CVE-2024-7056.htmlhttps://patchthecve.com/cve/CVE-2024-7056.htmlWed, 17 Jun 2026 08:19:16 +0000LOW 3.5: The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-10593.htmlhttps://patchthecve.com/cve/CVE-2024-10593.htmlWed, 17 Jun 2026 06:55:59 +0000MEDIUM 4.3: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This ma