Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

@ainsleydev/payload-helper (>=0.0.24, <=0.3.2), @contentql/core (>=0.3.1, <=0.3.5) +3 more potentially affected by CVE-2026-105857 via @payloadcms/plugin-form-builder (>=1.2.3, <=3.86.0)

@payloadcms/plugin-form-builder NPM version =1.2.3, =0.0.24, =0.3.1, =1.0.117, =1.0.118 - kollab-payload-template 1.0.0 - yak-payload-testbed 1.2.3 Source cves: CVE-2026-105857 Source advisory: MEND:CVE-2026-105857...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857

The Payload headless content management system is vulnerable to Remote Code Execution (RCE) via the @payloadcms/plugin-form-builder component. An attacker can exploit this by crafting a malicious form submission to execute code remotely on the server. This issue is linked to CWE-94 (Code Injectio...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-40807

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-41555

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

CVE-2026-39731

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39745

Unauthenticated Cross Site Scripting XSS in Contact Form to DB by BestWebSoft = 1.7.6 versions...

CVE-2026-104814

Unauthenticated Cross Site Scripting XSS in Form Block = 1.8.1 versions...

CVE-2026-104814 WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Block = 1.8.1 versions...

EUVD-2026-93082

Unauthenticated Cross Site Scripting XSS in Form Block = 1.8.1 versions...

CVE-2026-104814 WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Block = 1.8.1 versions...

CVE-2026-104814

The Form Block WordPress plugin in versions

CVE-2026-41555 WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...

CVE-2026-40807 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.6 versions...