Skip to content
Sign in
6.5 Medium

CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values…

Description

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

Affected products and versions

Product Affected versions Fixed in
WPForms 1.5 1.5.0.1 → < 2.0.2.1 2.0.2.1

Other CVEs of WPForms

The 5 CVEs of WPForms →
CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form… 6.8 Medium CVE-2026-4986 The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events… 5.3 Medium CVE-2024-11223 The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high… 4.7 Medium CVE-2024-7056 The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high… 3.5 Low
Track this CVE