Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-25339 EUVD-2026-15649GHSA-r5wr-5hhj-7hjx

WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

Published Mar 25, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Description

Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.

Affected products

VendorProductAffectedFixed
Syed Balkhi Contact Form by WPForms ≤ 1.9.8.7 —

References