Is Wpforms Lite safe? Known vulnerabilities & security (2026)

Known vulnerabilities, PHP compatibility and safer alternatives for the Wpforms Lite WordPress plugin — checked against WP Clinic's local security database.

Plugin details

Slug: wpforms-lite
Requires PHP: 7.2+

Known vulnerabilities

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.5.9 [CVE-2020-10385, WordPress Contact Form by WPForms plugin <= 1.5.8.2 - Authenticated Cross-Site Scripting (XSS) vulnerability, Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting, Contact Form by WPForms < 1.5.9 - Authenticated Cross-Site Scripting (XSS)]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.6.0.2 [WordPress Contact Form by WPForms plugin <= 1.6.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8.1 [WordPress Contact Form by WPForms plugin <= 1.4.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8 [WordPress Contact Form by WPForms plugin <= 1.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.7.5.5 [WordPress Contact Form by WPForms plugin <= 1.7.5.3 - Authenticated Arbitrary File Access vulnerability]

+ 25 more known vulnerabilities

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.7.5.5 [Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.6.0.2 [Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8.1 [Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8 [Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.8.1.3 [CVE-2023-30500, WordPress Contact Form by WPForms Plugin <= 1.8.1.2 is vulnerable to Cross Site Scripting (XSS), Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting, Contact Form by WPForms < 1.8.1.3 - Reflected XSS]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.7.5.5 [Contact Form by WPForms < 1.7.5.5 - Admin+ Arbitrary File Access]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.6.0.2 [Contact Form by WPForms < 1.6.0.2 - Authenticated Stored Cross-Site Scripting (XSS)]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8.1 [Contact Form by WPForms < 1.4.8.1 - Unauthenticated Cross-Site Scripting (XSS)]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.4.8 [Contact Form by WPForms < 1.4.8 - Authenticated Stored Cross-Site Scripting (XSS)]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.8.8.2 [CVE-2024-3649, Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation, WordPress Contact Form by WPForms Plugin <= 1.8.7.2 is vulnerable to Broken Access Control]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.2.1 [CVE-2024-10593, WordPress Contact Form by WPForms Plugin <= 1.9.1.6 is vulnerable to Cross Site Request Forgery (CSRF), WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.1.6 [CVE-2024-7056, WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting, WordPress Contact Form by WPForms Plugin < 1.9.1.6 is vulnerable to Cross Site Scripting (XSS)]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] >= 1.8.4 - <= 1.9.2.1 [CVE-2024-11205, WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation, WordPress Contact Form by WPForms Plugin 1.8.4-1.9.2.1 is vulnerable to Broken Access Control]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.2.3 [CVE-2024-11223, WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.2.3 [CVE-2024-56276, Contact Form by WPForms <= 1.9.2.2 - Missing Authorization, EUVD-2024-53073]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.3.2 [CVE-2024-13403, WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter, EUVD-2024-51582]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.5.1 [CVE-2025-3794, WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter, EUVD-2025-14199]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] == 1.7.8 [CVE-2020-36919]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.9.4 [CVE-2026-32446, Contact Form by WPForms <= 1.9.9.3 - Missing Authorization]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.9.9.2 [CVE-2026-25339, WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.3 [CVE-2026-40764, Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.5 [CVE-2026-48835, WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization, WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.5 [CVE-2026-7792, WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint, WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint, EUVD-2026-34954]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.5 [CVE-2026-4986]
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.2.1 [CVE-2026-12127, WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

Contact Form 7 — 10000000+ active installs — max PHP 8.4
Akismet Anti-spam: Spam Protection — 6000000+ active installs — max PHP 8.4
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — max PHP <8.0
Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs
Ninja Forms – The Contact Form Builder That Grows With You — 600000+ active installs

Is Wpforms Lite safe?

Plugin details

Known vulnerabilities

Safer / more established alternatives

Check your own WordPress site