CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database 150,000+ Verified Exploits & PoCs for Cybersecurity Research All In One Place Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 Abo...

WordPress Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin <= 1.0.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by samathakeeling in WordPress Plugin Chatterbug Forms – Fast, Flexible WordPress Form Builder versions = 1.0.2...

CVE-2026-5118

⚡ CVE-2026-5118 Divi Form Builder — Unauthenticated Privilege Escalation "Security Research" • "Defensive Detection" • "Vulnerability Research" --- 🔥 Overview CVE-2026-5118 is an unauthenticated privilege-escalation vulnerability affecting Divi Form Builder versions up to 5.1.2. The issue involve...

NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS

NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wpajaxnoprivsubmitnexform handler for form submissions. Array-type field values are processed through restsanitizearray, which only reindexes th...

WordPress Visual Form Builder <3.0.8 - Information Disclosure

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE

The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the doimageupload AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...

CVE-2026-5118

Divi Form Builder ⚠️ WARNING: This tool is for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test. More Disclaimer You can see the disclaimer on the cover of...

CVE-2026-5118

CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder One hidden field. One changed value. Full access to the entire website. 🧨 What an Attacker Can Do? Capability| Impact ---|--- 🔑 Create admin account without login| Full Site Takeover 📦 Access WooCommerce customer data| Data Breach 💉 Edit plugin/theme files PHP|...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

VulnCheck KEV: CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-120513

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-120513

The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to unauthenticated arbitrary file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function. Attackers can delete files within the wp-content/uploads directory, potentia...

CVE-2026-122231

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field00' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-119183

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-119154

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field00' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-118972

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...