WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in WS Form LITE – Drag & Drop Contact Form Builder

Contact form builder for WordPress. Create professional, accessible, mobile-friendly forms in minutes without coding.

11Reported vulnerabilities
9.8Highest CVSS score
1.12.6Latest version
10,000+Active installs

What to do now

Update WS Form LITE – Drag & Drop Contact Form Builder to 1.10.82 or later. 11 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 13, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2026-4703 Critical 9.8 0.6% 0 to 1.10.80 (inclusive) 1.10.82 August 22, 2026
CVE-2022-23988 High 7.2 2.2% Before 1.8.176 1.8.176 January 31, 2022
CVE-2023-52135 High 7.2 0.5% 1.9.170 and earlier 1.9.171 December 29, 2023
CVE-2024-13509 Medium 6.1 0.4% 0 to 1.10.13 (inclusive)
0 to 1.10.13 (inclusive)		 1.10.14 January 28, 2025
CVE-2024-10647 Medium 6.1 0.3% 0 to 1.9.244 (inclusive) 1.9.245 November 6, 2024
CVE-2024-47320 Medium 6.1 0.3% 1.9.238 and earlier 1.9.244 September 25, 2024
CVE-2025-3912 Medium 5.3 0.4% 0 to 1.10.35 (inclusive) 1.10.36 April 25, 2025
WF-d99f81ea-1e74-4b67-a6c5-3dbc7865a68a Medium 5.3 — 1.9.117 and earlier 1.9.118 May 23, 2023
CVE-2022-23987 Medium 4.8 0.6% Before 1.8.176 1.8.176 January 31, 2022
CVE-2023-5424 Medium 4.7 0.5% 1.9.217 and earlier 1.9.218 June 6, 2024
CVE-2026-11562 Medium 4.3 0.3% 1.11.7 and earlier 1.11.8 July 10, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.