WPForms

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenOct 1, 2026
Last mentionedOct 1, 2026

Timeline

1 articles · newest first

Vulnerability & Patch Roundup — September 2026

Sucuri's September 2026 roundup covers WordPress plugin patches including unauthenticated DoS in WooCommerce and arbitrary shortcode execution in WPForms.

Sucuri BlogOct 1, 04:30 UTC · Oct 1, 2026VulnerabilityCVE-2026-48888 CVE-2026-84761 CVE-2026-57777+9

Related CVEs

by mentions

CVE-2026-57777<1%7.6
Blind SQL Injection in Automattic WooCommerce (WordPress)
published Sep 4, 2026Automattic WooCommerce (WordPress plugin)
CVE-2026-48888<1%7.5
Unauthenticated resource-exhaustion DoS in WooCommerce before 11.1.0
published Sep 8, 2026Automattic WooCommerce
CVE-2026-749916.8
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on…
published Sep 24, 2026WordPress
CVE-2026-847446.5
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the…
published Sep 28, 2026WordPress
CVE-2026-889966.1
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site…
published Sep 25, 2026WordPress
CVE-2026-890645.3
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110
published Sep 17, 2026WordPress
CVE-2026-828415.3
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus
published Sep 27, 2026WordPress
CVE-2026-765794.7
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due…
published Sep 19, 2026WordPress
CVE-2026-77783<1%3.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing…
published Sep 2, 2026WordPress
CVE-2026-77784<1%2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing…
published Sep 2, 2026WordPress

Appears with

LiteSpeed Cacheorganization · 1
Sucuriorganization · 1
UpdraftPlusorganization · 1
All-in-One WP Migrationorganization · 1
WooCommerceorganization · 1
Rank Math SEOorganization · 1

Entities are extracted by the model from each article. First seen Oct 1, 2026, last mentioned Oct 1, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.