WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in cformsII

This is a fork of cformsII, a highly customizable, flexible and powerful form builder plugin, covering a variety of use cases and features.

15Reported vulnerabilities
9.8Highest CVSS score
15.1.4Latest version
3,000+Active installs

What to do now

Update cformsII to 15.1.4 or later. 15 of these have a fixed version available. Updating resolves them.

Plugin last updated: April 11, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2019-15238 High 8.8 0.7% Before 15.0.2 15.0.2 August 20, 2019
CVE-2014-9473 High 7.5 13.8% 14.7 and earlier 14.8 January 8, 2015
CVE-2017-18570 Critical 9.8 1.8% Before 14.13 14.13 August 22, 2019
CVE-2015-9333 Critical 9.8 1.8% Before 14.6.10 14.6.10 August 22, 2019
CVE-2010-3977 Medium 6.1 4.2% 11.5 and earlier 11.6.1 November 2, 2010
CVE-2024-22149 High 7.2 0.4% 15.0.6 and earlier 15.0.7 January 15, 2024
CVE-2026-39435 High 7.2 0.2% 15.1.3 and earlier 15.1.4 June 1, 2026
CVE-2014-10393 Medium 6.1 0.9% Before 10.5 10.5 August 22, 2019
CVE-2014-10392 Medium 6.1 0.9% Before 10.2 10.2 August 22, 2019
CVE-2017-18559 Medium 6.1 0.9% Before 14.13.3 14.13.3 August 21, 2019
CVE-2014-10377 Medium 6.1 0.9% Before 13.2 13.2 August 21, 2019
WF-4bc58312-ef3d-487b-87fb-9a15a8c6559f Medium 5.3 — 14.10.1 and earlier 14.11 December 15, 2010
CVE-2023-52203 Medium 4.4 0.3% 15.0.6 and earlier 15.0.7 January 3, 2024
CVE-2026-39436 Medium 4.3 0.1% 15.1.3 and earlier 15.1.4 May 25, 2026
CVE-2023-25449 Medium 4.3 0.3% 15.0.4 and earlier 15.0.5 March 8, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.