plugin
27 known security issues reported for the Cforms2 WordPress plugin. Most recent disclosed Jun 1, 2026.
Running Cforms2 on your site? Check whether your installed version is affected.
Scan your site freeThe cformsII plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 15.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an...
The cformsII plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 15.1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann CformsII allows Stored XSS.This issue affects CformsII: from n/a through 15.0.5.
The cformsII plugin for WordPress is vulnerable to stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 15.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.
The cformsII plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 15.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitra...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.
The cformsII plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 15.0.4. This is due to missing or incorrect nonce validation in the 'cforms-options.php', 'cforms-global-settings.php', 'cforms-corrupted.php' files. This makes it possible for unauthenticated attackers to up...
[en] The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
[en] The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
[en] The cforms2 plugin before 10.2 for WordPress has XSS.
[en] The cforms2 plugin before 10.5 for WordPress has XSS.
[en] The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
[en] The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
[en] The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Unauthenticated HTML Injection & Cross-Site Request Forgery (CSRF) vulnerabilities found by Jerome Bruandet (Nintechnet) in WordPress CformsII plugin (versions <= 15.0.1).
The cformsII plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 14.13.2 due to insufficient input sanitization and output escaping on the 'switchform', 'pickform', and 'noSub' parameters. This makes it possible for attackers to inject arbitrary web scripts that execute in a vic...
The cformsII plugin for WordPress is vulnerable to generic SQL Injection via Delete Entries or Download Entries in versions up to, and including, 14.12.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for highly-privilege...
The cforms2 plugin before 14.6.10 for WordPress has SQL injection via several parameters.
[en] Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the defa...
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default u...
The cforms II(2) plugin before 13.2 for WordPress has XSS in lib_ajax.php.
The CformsII plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 14.10.1. This is due to the codes not being one-time use and improper verification of user-supplied data. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.
The CformsII plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 14.10.1. This is due to the codes not being one-time use and improper verification of user-supplied data. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cformsII(cforms 2) WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
The cformsII plugin (slug: cforms) and its fork (slug: cforms2) have a CAPTCHA Bypass vulnerability. The MD5 hash for matching the answer is sent with the forms and so it can be overwritten. This is fixed in the fork (cforms2) with version 14.11 (see changelog for confirmation). The original delicious:days version (cfo...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free