WordPress plugin
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High0
- Medium1
- Low0
All SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data ≤3.10.2Update to 3.11.0 | CVE-2026-118235 | |
| Critical9.8 | Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register ≤3.10.0Update to 3.10.1 | CVE-2026-104748 |
- Critical9.8Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
≤3.10.2Update to 3.11.0
- Critical9.8Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
≤3.10.0Update to 3.10.1
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: common questions
Does SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: 2 critical, 1 medium. None are known to affect version null.
How do I check which version of SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications vulnerability?
CVE-2026-118235, published Oct 30, 2026: SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data. Severity: Critical (CVSS 9.8).
Is any SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications vulnerability listed in CISA KEV?
No. None of the known SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications vulnerabilities is currently listed in the CISA KEV catalog.