CVE-2020-36919

Medium · 6.1

CVSS

6.1

EPSS

0.4%

Published

Jan 13, 2026

CISA due date

—

The record

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.

Affected packages

Ecosystem	Package	Introduced	Fixed