34605 matches found
CVE-2026-5116: Improper Neutralization of Input During Web Page Generation
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...
CSRF vulnerability in jenkins-multijob-plugin allows arbitrary code execution
jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...
PT-2026-68466
Name of the Vulnerable Software and Affected Versions FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More versions prior to 1.9.3 Description Stored Cross-Site Scripting occurs via form submission fields due to insufficient input sanitization and output...
PT-2026-68033
Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...
PT-2026-68115
Name of the Vulnerable Software and Affected Versions 299Ko affected versions not specified Description An unauthenticated attacker can perform a reflected Cross-Site Scripting XSS attack via the public contact form. The issue occurs because the home function in...
PT-2026-67977
Name of the Vulnerable Software and Affected Versions Bit Form WordPress plugin versions prior to 3.2.0 Description Stored Cross-Site Scripting occurs because the plugin fails to sanitize uploaded signature images before storage. This allows unauthenticated attackers to upload a specially crafted...
CVE-2026-71249: Improper Neutralization of Input During Web Page Generation
299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...
CVE-2026-6627: Missing Authorization
The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...
PT-2026-68020
Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension versions prior to 5.0.6 Description Stored Cross-Site Scripting occurs due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...
MAL-2026-11522 Malicious code in beaver-ui-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15307 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15830 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
WordPress DTX – Dynamic Text Extension for Contact Form 7 plugin <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by SATYARTH PRAKASH XoxoL33t in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15830 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
Malicious code in @servicetitan/marketing-form (npm)
npm/@servicetitan/marketing-form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malware in @servicetitan/marketing-form
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CLSA-2026-1784943225 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.5...