1487 matches found
CVE-2026-17571: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-7623: Improper Neutralization of Input During Web Page Generation
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...
PT-2026-67058
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-67074
Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4 Description An arbitrary file deletion issue exists due to path traversal. The delete file AJAX handler retrieves a file path from the database and passes it to the unlink functi...
CVE-2026-17567: Authorization Bypass Through User-Controlled Key
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
CVE-2026-16655: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...
CVE-2026-15663: Improper Neutralization of Special Elements used in an SQL Command
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-59517
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
CVE-2026-59517 WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
CVE-2026-59517 WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
CVE-2026-59517
CVE-2026-59517 concerns the WordPress plugin Easy Form Builder (versions <= 4.0.12). The supplied documents confirm an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting this plugin, with the affected component/version explicitly stated as Easy Form Builder
EUVD-2026-48188
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
CVE-2026-59517: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
PT-2026-63846
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Easy Form Builder versions = 4.0.12...
WordPress Easy Form Builder by WhiteStudio – Drag & Drop Form Builder plugin <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator vulnerability
Unauthenticated Privilege Escalation to Administrator vulnerability discovered by ? in WordPress Plugin Easy Form Builder versions = 4.0.11...
CVE-2026-13439
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...
CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...
CVE-2026-13439
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...
CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...