Hur vet jag om min sajt är påverkad?

Kör ett gratis test på sitesupport.co/testa-din-hemsida. Testet kontrollerar vilka tillägg och versioner du använder och jämför mot kända sårbarheter.

Vad ska jag göra om jag har en sårbar version?

Uppdatera till senaste versionen så snart som möjligt. Om ingen fix finns tillgänglig, överväg att tillfälligt inaktivera tillägget.

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

Name: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Rating: 4.8

4.8/5

6 000 000+ installationer

The best WordPress contact form plugin. Drag & Drop form builder to create beautiful contact forms, payment forms, & other custom forms.

Kända sårbarheter

Kritiska / höga

2026-03-03

Senaste sårbarhet

6 000 000+

Aktiva installationer

Om WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

WPForms – Populärt men säkerhetsutmanat formulärtillägg

WPForms är ett av WordPress mest använda formulärtillägg med över 6 miljoner aktiva installationer. Det erbjuder en användarvänlig drag-and-drop-editor för att skapa kontaktformulär, betalningsformulär och enkäter utan programmeringskunskaper.

Säkerhetsläget i siffror

Tillägget har 27 registrerade särbarheter, varav 4 klassas som kritiska och 2 som högallvarliga. Denna siffra kan verka skrämmande, men det är viktigt att förstå att många sårbarheter har åtgärdats i senare versioner. De kritiska sårbarheterna kan potentiellt ge angripare möjlighet att komma åt känslig data eller ta kontroll över webbplatsen.

Praktiska rekommendationer

Trots säkerhetsutmaningarna kan WPForms användas säkert genom att:

Alltid hålla tillägget uppdaterat till senaste versionen
Använda starka lösenord och tvåfaktorsautentisering
Regelbundet säkerhetskopiera webbplatsen
Övervåka webbplatsens aktivitet för ovanliga händelser

Med WPForms popularitet arbetar utvecklarna aktivt med säkerhetspatchar. Regelbundna uppdateringar är det absolut bästa skyddet mot kända sårbarheter och säkerställer att du drar nytta av de senaste säkerhetslösningarna.

Använder du WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More?

Kör ett gratis test och se om din hemsida är påverkad av dessa sårbarheter.

Testa din hemsida

Alla kända sårbarheter

Hög 2026-03-03 CVE-2026-2568

CVE-2026-2568: The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, a...

Påverkade versioner: unresolvable

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitiz...

Medel 2026-01-28 CVE-2026-0825

CVE-2026-0825: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions...

Påverkade versioner: unresolvable

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible...

Hög 2025-09-19 CVE-2025-10647

CVE-2025-10647: The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and...

Påverkade versioner: all

The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and including, 1.1.5. This makes it possible for authent...

Kritisk 2025-08-13 CVE-2025-7384

CVE-2025-7384: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted inp...

Påverkade versioner: all

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it pos...

Kritisk 2025-07-19 CVE-2025-7697

CVE-2025-7697: The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via dese...

Påverkade versioner: all

The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input within the verify_fiel...

Kritisk 2025-07-19 CVE-2025-7696

CVE-2025-7696: The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserial...

Påverkade versioner: all

The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_va...

Medel 2025-05-30 CVE-2025-4659

CVE-2025-4659: The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4...

Påverkade versioner: all

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attacker...

Medel 2025-05-09 CVE-2025-3794

CVE-2025-3794: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter...

Påverkade versioner: all

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insuf...

Medel 2025-02-12 CVE-2024-12164

CVE-2024-12164: The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset...

Påverkade versioner: < 1.6.1

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset_settings() function in all versions up to, and includi...

Medel 2025-02-04 CVE-2024-13403

CVE-2024-13403: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter...

Påverkade versioner: < 1.9.3.2

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insuffi...

Medel 2025-01-15 CVE-2024-12593

CVE-2024-12593: The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode in all versions up to, and including, ...

Påverkade versioner: all

The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and outp...

Medel 2024-12-26 CVE-2024-11223

CVE-2024-11223: The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks e...

Påverkade versioner: < 1.9.2.3

The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed...

Medel 2024-12-10 CVE-2024-11205

CVE-2024-11205: The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, ...

Påverkade versioner: < 1.9.2.2

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for au...

Låg 2024-11-25 CVE-2024-7056

CVE-2024-7056: The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks e...

Påverkade versioner: < 1.9.1.6

The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed...

Medel 2024-11-13 CVE-2024-10593

CVE-2024-10593: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi...

Påverkade versioner: < 1.9.2.1

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce va...

Medel 2024-10-25 CVE-2024-10016

CVE-2024-10016: The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitiz...

Påverkade versioner: all

The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Medel 2024-08-12 CVE-2024-7414

CVE-2024-7414: The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the compose...

Påverkade versioner: all

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has display_errors on. This m...

Medel 2024-05-02 CVE-2024-3649

CVE-2024-3649: The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of c...

Påverkade versioner: all

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it po...

Medel 2024-02-05 CVE-2024-0374

CVE-2024-0374: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is ...

Påverkade versioner: <= 3.2.2

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'cr...

Medel 2024-02-05 CVE-2024-0373

CVE-2024-0373: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is ...

Påverkade versioner: <= 3.2.2

Medel 2024-02-05 CVE-2024-0372

CVE-2024-0372: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_f...

Påverkade versioner: <= 3.2.2

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3...

Medel 2024-02-05 CVE-2024-0371

CVE-2024-0371: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'crea...

Påverkade versioner: <= 3.2.2

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'create_view' function in all versions up to, and including,...

Medel 2024-02-05 CVE-2024-0370

CVE-2024-0370: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save...

Påverkade versioner: <= 3.2.2

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_view' function in all versions up to, and including, 3...

Medel 2024-01-20 CVE-2023-7063

CVE-2023-7063: The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization...

Påverkade versioner: <= 1.8.5.3

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unau...

Medel 2023-07-04 CVE-2023-2321

CVE-2023-2321: The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, l...

Påverkade versioner: < 3.4.6

The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which coul...

Kritisk 2022-11-14 CVE-2022-3574

CVE-2022-3574: The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

Påverkade versioner: < 1.7.7

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

Medel 2020-03-24 CVE-2020-10385

CVE-2020-10385: A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

Påverkade versioner: < 1.5.9

A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.

Så skyddar du din sajt

Sårbarheter i tillägg är den vanligaste attackytan för WordPress-sajter. Det bästa skyddet är att vara proaktiv — här är tre konkreta steg.

Håll tillägget uppdaterat

De flesta sårbarheter i WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More åtgärdas snabbt av utvecklarna. Uppdatera alltid till senaste versionen.

Ta bort oanvända tillägg

Varje tillägg är en potentiell attackyta. Avinstallera det du inte aktivt använder.

Bevaka automatiskt

Med löpande övervakning upptäcker du problem innan de blir allvarliga.

Vill du slippa hålla koll själv? Med ett supportavtal från Sitesupport sköter vi uppdateringar och säkerhet åt dig.

Vanliga frågor om WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More har 27 kända sårbarheter, varav 6 med hög eller kritisk allvarlighetsgrad. Det betyder inte nödvändigtvis att tillägget är osäkert — de flesta sårbarheter åtgärdas i nya versioner. Det viktigaste är att alltid köra den senaste versionen.

Det enklaste sättet är att köra ett gratis test av din hemsida på sitesupport.co. Testet kontrollerar vilka tillägg du använder och vilka versioner som är installerade, och jämför det mot kända sårbarheter.

Uppdatera till den senaste versionen så snart som möjligt. Om det inte finns en uppdatering som åtgärdar problemet bör du överväga att tillfälligt inaktivera tillägget, särskilt om sårbarheten har kritisk eller hög allvarlighetsgrad.

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More har över 6 000 000 aktiva installationer på WordPress.org och ett betyg på 4.8 av 5. Populära tillägg har generellt bättre säkerhetsrutiner tack vare större community och fler ögon på koden.