weforms_easy_drag_drop_contact_form_builder_for_wordpress vulnerabilities

CVEs whose affected-version data names the weforms_easy_drag_drop_contact_form_builder_for_wordpress package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110253Medium· 5.4

today

weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions…

▾ Sunlitboldgrid · weForms – Easy Drag & Drop Contact Form Builder For WordPressvia CVEORG