WordPress cforms2 has 8 known advisories in the phpwarden feed. Feed 2026.10.29.3, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2014-9473 | Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to e | high | 7.5 | <=14.7 | – |
| CVE-2015-9333 | The cforms2 plugin before 14.6.10 for WordPress has SQL injection. | critical | 9.8 | <14.6.10 | 14.6.10 |
| CVE-2017-18570 | The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries. | critical | 9.8 | <14.13 | 14.13 |
| CVE-2014-10392 | The cforms2 plugin before 10.2 for WordPress has XSS. | medium | 6.1 | <10.2 | 10.2 |
| CVE-2014-10377 | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. | medium | 6.1 | <13.2 | 13.2 |
| CVE-2017-18559 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. | medium | 6.1 | <14.13.3 | 14.13.3 |
| CVE-2014-10393 | The cforms2 plugin before 10.5 for WordPress has XSS. | medium | 6.1 | <10.5 | 10.5 |
| CVE-2019-15238 | The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. | high | 8.8 | <15.0.2 | 15.0.2 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked