WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.51...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

WordPress jet-form-builder-stripe-gateway plugin < 1.1.0 - Unauthenticated Blind SQLi vulnerability

Unauthenticated Blind SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Jet Form Builder Stripe Gateway versions 1.1.0...

Malicious Package

Overview tailwind-form-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-diesel-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-98262

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...

PT-2026-98264

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form...

CVE-2026-48543: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...

EUVD-2026-42394

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict...

GHSA-9643-4QGH-G8MX elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...

CVE-2026-95529

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-95586

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

CVE-2026-76086

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

GHSA-V3F3-CMJ4-CVJ9 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Impact The control panel action formie/integrations/form-settings IntegrationsController::actionFormSettings was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the formie/integrations/form-settings action in the control panel. An attacker can access and modify integration settings, potentially exfiltrating stored API keys or OAuth tokens by redirecting...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

EUVD-2026-85545

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...