← WordPress Vulnerabilities
WordPress security by component

Smart Forms

Smart Forms is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Feb 14, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: smart-forms

CVE-2026-2022: Smart Forms: A security weakness

Smart Forms is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

PublishedFeb 14, 2026
Safe version guidanceSee mitigation notes
Safe version
Feb 14, 2026 CVE-2026-2022
Smart Forms: A security weakness
Smart Forms is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
May 24, 2025 CVE-2025-5055
Smart Forms – when you need more than just a contact form: Cross-site scripting
Smart Forms – when you need more than just a contact form is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.4
NVDPending
Dec 09, 2024 CVE-2023-49856
Smart Forms: A security weakness
Smart Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE8.1
NVD8.8
Apr 29, 2024 CVE-2024-33593
Smart Forms: A security weakness
Smart Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
Apr 29, 2024 CVE-2024-1905
Smart Forms: Cross-site scripting
Smart Forms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.9
NVDPending
Apr 15, 2024 CVE-2024-1307
Smart Forms: A security weakness
Smart Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVDPending
Apr 15, 2024 CVE-2024-1306
Smart Forms: Cross-site request forgery
Smart Forms is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVDPending
Feb 27, 2024 CVE-2023-7203
Smart Forms: Cross-site request forgery
Smart Forms is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE6.1
NVDPending
Mar 07, 2022 CVE-2022-0163
Smart Forms: A security weakness
Smart Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVD6.5
Mar 12, 2019 CVE-2019-5924
Smart Forms: Cross-site request forgery
Smart Forms is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE8.8
NVD8.8