11697 matches found
CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...
CVE-2026-15748
Wordfence analysis confirms an unauthenticated attacker can chain a forged Select-field record with the regex-compatible ph(p)|text/x-php pattern to bypass the forminator_allowed_mime_types() exact-key blocklist, upload executable PHP, and achieve RCE on sites with a custom upload root lacking .h...
CVE-2026-75091
The Quill Forms WordPress plugin (versions ≤ 5.7.1) has a stored XSS flaw from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when users view affected pages. CVSS 7.2 HIGH; no confirmed in-the-wild exploitation reported. Patc...
CVE-2026-75091
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-15748
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...
CVE-2026-66639: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
CVE-2026-74004: Missing Authorization
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms = 6.0 versions...
PT-2026-77035
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
PT-2026-76906
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-77061
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
PT-2026-77127
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-66633: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-75091: Improper Neutralization of Input During Web Page Generation
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-32466: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
PT-2026-77067
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
PT-2026-77044
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-28568: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
CVE-2026-15748: Unrestricted Upload of File with Dangerous Type
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by 0xVenus in WordPress Plugin Gravity Forms Bookings premium versions = 2.1...