11693 matches found
CVE-2026-77137
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...
CVE-2026-77137
CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...
EUVD-2026-65339
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...
TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027...
CVE-2026-18328
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-18323
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...
CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...
EUVD-2026-65314
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
EUVD-2026-65316
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-18323
The Forminator Forms plugin for WordPress (versions up to and including 1.57.0.2 ) is vulnerable to unauthenticated Stored XSS via the Radio Field "Save and Continue Draft" feature. The root cause is insufficient input sanitization and output escaping: the Save-and-Continue AJAX endpoint is regis...
CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-18328
The Forminator Forms WordPress plugin (all versions up to and including 1.57.0 ) is vulnerable to DOM-Based Reflected Cross-Site Scripting via the error_description parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...
CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
Exploit for CVE-2026-32475
CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File...
PT-2026-81190
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. Thi...
PT-2026-81189
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-77137: Improper Neutralization of Special Elements used in an SQL Command
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...