11509 matches found
CVE-2026-92229
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...
CVE-2026-84434
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...
CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...
CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...
EUVD-2026-83473
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...
CVE-2026-92229
The Forminator Forms plugin for WordPress (versions ≤ 1.57.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the improper validation of the current_url POST parameter (specifically during quiz AJAX actions such as forminator_submit_form_quizzes), which is refl...
EUVD-2026-83472
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...
CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...
CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...
CVE-2026-84434
Gravity Forms (WordPress plugin) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 3.1.0.4 . The root cause is a mismatch between the field validation pipeline and the file persistence pipeline: hidden file upload fields bypass extension validation, and a ...
PT-2026-95746
Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the...
CVE-2026-92229: Improper Control of Generation of Code
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...
PT-2026-95780
Name of the Vulnerable Software and Affected Versions Quill Forms | Conversational Multi Step Forms, Surveys & quizzes versions prior to 5.7.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...
CVE-2026-15664: Improper Neutralization of Input During Web Page Generation
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-84434: Unrestricted Upload of File with Dangerous Type
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...
PT-2026-95738
Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1 Description An arbitrary file upload issue exists in the Gravity Forms plugin for WordPress via the upload file function. The flaw stems from a mismatch between the field validation pipeline and the file...
Malicious code in tailwindcss-forms-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8 The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle 303-entry rotating string array,...
MAL-2026-16295 Malicious code in tailwindcss-forms-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8 The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle 303-entry rotating string array,...
WordPress Bricksforge plugin < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms vulnerability
Unauthenticated Arbitrary Password Reset via Pro Forms vulnerability discovered by moonge in WordPress Plugin Bricksforge versions 3.1.8.8...
WordPress Gravity Forms plugin <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability
Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Gravity Forms versions = 3.1.0.4...