CVE-2026-PoCs

CVE-2026-PoCs Проверенная коллекция эксплойтов Proof-of-Concept для CVE, опубликованных в 2026 году, собранная сообществом. Зачем этот репозиторий Большинство коллекций PoC для CVE разбросаны по твитам, гистам и мёртвым ссылкам на блоги. Этот репозиторий нацелен на то, чтобы стать единым, хорошо...

WordPress Visual Form Builder <3.0.8 - Information Disclosure

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder 인증되지 않은 RCE CVE-2026-5524 에 대한 대량 익스플로잇 툴킷으로, WordPress 플러그인 Divi Form Builder = 5.1.8의 인증되지 않은 임의 파일 업로드 취약점을 악용하여 원격 코드 실행으로 이어집니다. 필드| 값 ---|--- CVE| 2026-5524 CVSS| 9.8 치명적 벡터| AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 영향 범위| Divi Form Builder = 5.1.8 패치 버전| 5.1.9...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Неавторизованное повышение привилегий через внедрение роли 🔥 Краткое описание уязвимости Плагин WordPress Divi Form Builder версий = 5.1.2 уязвим к неавторизованному повышению привилегий. Эта критическая ошибка позволяет неавторизованным злоумышленникам...

CVE-2026-5118

Divi Form Builder ⚠️ 경고: 이 도구는 공인된 침투 테스트 및 보안 연구용입니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 소유권이 있거나 명시적인 서면 허가를 받은 시스템에서만 사용하십시오. 추가 면책 조항: Jenderal92의 표지에서 면책 조항을 확인할 수 있습니다. 여기서 확인하세요 !!! 개요 이 Python 2 스크립트는 Divi WordPress 플러그인및 관련 Divi 양식의 권한 상승 취약점을 악용합니다. 다음 방법을 통해 원격으로 관리자 계정을 등록할 수 있습니다: 대상의 Divi 등록...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 숨겨진 필드 하나. 변경된 값 하나. 전체 웹사이트에 대한 완전한 액세스. 🧨 공격자가 할 수 있는 일 능력| 영향 ---|--- 🔑 로그인 없이 관리자 계정 생성| 전체 사이트 장악 📦 WooCommerce 고객 데이터 액세스| 데이터 유출 💉 플러그인/테마 파일PHP 편집| 원격 코드 실행 🕳️ 숨겨진 백도어 생성| 지속적 액세스 👥 모든 사용자 데이터 열람| 개인정보 침해 🔬 취약점 분석 취약점 위치 root@kitploit:...

CVE-2026-5118

CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...

CVE-2026-14558

CVE-2026-14558 affects the WP User Frontend WordPress plugin prior to 4.3.10 . The flaw lies in the AI Form Builder component, which does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts. Users with Editor-level access (or ...

CVE-2026-17123

The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

EUVD-2026-53880

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425

Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.

CVE-2026-66425

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-15052

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15052

Affected software: MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress (versions ≤ 4.3.3). Vulnerability type & root cause: Stored Cross‑Site Scripting due to insufficient input sanitization and output escaping in form field handling. Impact: Unauthenticated ...

CVE-2026-59517

CVE-2026-59517 concerns the WordPress plugin Easy Form Builder (versions &lt;= 4.0.12). The supplied documents confirm an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting this plugin, with the affected component/version explicitly stated as Easy Form Builder

EUVD-2026-48188

Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...