CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin (versions before 4.2.2 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The issue arises because the plugin's PDF renderer does not restrict the destination of image fetches performed on submitted form content. An at...

EUVD-2026-82683

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

EUVD-2026-82666

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

EUVD-2026-82665

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin, versions 4.0.0-4.1.3 , is vulnerable to an unauthenticated registration policy bypass . The flaw exists because the plugin fails to validate submitted values against stored configurations for certain form types, specifically involving Login F...

CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin, in versions before 4.2.0 (specifically identified as 4.0.0-4.1.3 in some records), is vulnerable to Stored XSS . The root cause is a failure to validate submitted values against stored configurations for certain form types. This allows unauth...

CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

MAL-2026-16282 Malicious code in tailwindcss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2 Package name mimics the legitimate tailwindcss-forms plugin repo field points at tailwindlabs/tailwindcss-forms but the main entry src/index.js is an...

Malicious code in tailwindcss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2 Package name mimics the legitimate tailwindcss-forms plugin repo field points at tailwindlabs/tailwindcss-forms but the main entry src/index.js is an...

Malicious Package

Overview tailwindcss-contact-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tailwindcss-form-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview tailwindcss-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwindcss-form-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-95256

Name of the Vulnerable Software and Affected Versions Generate PDF using Contact Form 7 versions prior to 4.2.2 Description The plugin fails to restrict the destination of image fetches performed by its PDF renderer on submitted form content. This allows unauthenticated users to execute a...

PT-2026-95238

Name of the Vulnerable Software and Affected Versions Easy Form Builder by WhiteStudio versions prior to 4.2.0 Description Lack of validation for submitted values against stored configurations in certain form types allows unauthenticated users to store arbitrary content. This content is...