UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2020-36919

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

Severity
Medium 5.1
Published
13 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Also known as
WPV-91b69d080015
Sources
NVD, WPVulnerability

Description

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.

Affected software

SoftwareAffected versions
WPFormsServers and applications · cpe:a:wpforms:wpforms
  • Every version up to 1.7.8
WPForms LiteWordPress plugins · wp-plugin:wpforms-lite
  • Version 1.7.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-36919
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-36919