Gsheetconnector Wpforms Vulnerabilities

The GSheetConnector For WPForms – WPForms Google Sheets Integration (Real-Time Sync) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.

CVSS:

8.8

Affected:

up to 4.0.1

Fixed in:

4.0.2

Disclosed:

Feb 4, 2026

CVE-2025-67979 on NVD →

The GSheetConnector For WPForms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.0.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.0.0

Fixed in:

4.0.1

Disclosed:

Dec 4, 2025

CVE-2025-67570 on NVD →

The WPForms Google Sheet Connector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping on the 'code' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVSS:

6.1

Affected:

up to 3.4.5

Fixed in:

3.4.6

Disclosed:

Jun 12, 2023

CVE-2023-2321 on NVD →