plugin
15 known security issues reported for the Wpgform WordPress plugin. Most recent disclosed Nov 28, 2022.
Running Wpgform on your site? Check whether your installed version is affected.
Scan your site free[en] The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Google Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 0.95 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execut...
[en] The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
Unauthenticated Server-Side Request Forgery (SSRF) vulnerability found by Jouko Pynnönen in WordPress Google Forms plugin (versions <=0.91).
The Google Forms plugin for WordPress is vulnerable to Server Side Request Forgery in versions before 0.92. This allowed Unauthenticated attackers to proxy requests through the plugin to an attacker-controlled host, which could also lead to a reflected Cross-Site Scripting scenario.
The Google Forms plugin for WordPress is vulnerable to Server Side Request Forgery in versions before 0.92. This allowed Unauthenticated attackers to proxy requests through the plugin to an attacker-controlled host, which could also lead to a reflected Cross-Site Scripting scenario.
The Google Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.90 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. This vulnerability was confirmed to allow the unauthenticated attacker to remotely execute code.
The Google Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.90 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. This vulnerability was confirmed to allow the unauthenticated attacker to remotely execute code.
The Google Forms plugin for WordPress is vulnerable to Cross-Site Scripting via the 'page' parameter in versions before 0.85 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Because of this vulnerability, attackers can steal Administrators' session tokens or perform arbitrary actions on their behalf. Update the plugin.
The Google Forms plugin for WordPress is vulnerable to Cross-Site Scripting via the 'page' parameter in versions before 0.85 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The Google Forms WordPress plugin was affected by an Unauthenticated Server-Side Request Forgery (SSRF) security vulnerability.
The Google Forms WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability.
The Google Forms WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free