571 matches found
0-click-RCE-Exploit-for-CVE-2024-51791
CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...
CVE-2026-96767
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
EUVD-2026-112745
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-96767
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.3.2 . The root cause is insufficient input sanitization and output escaping related to the 'type' parameter . This flaw allows unauthenticated attackers to ...
WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...
PT-2026-132098
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-96767: webaways NEX-Forms – Ultimate Forms Plugin for WordPress: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-67187
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...
PT-2026-128261
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF Abstracts List falls through to a...
PT-2026-95293
Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params...
CVE-2026-75961: Improper Neutralization of Special Elements used in an SQL Command
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-15602: Improper Neutralization of Special Elements used in an SQL Command
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16144
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...
CVE-2026-15450
The CVE-2026-15450 entry concerns Nex Forms – Ultimate Form Builder – Lite for WordPress (versions ≤ 9.2.3). Affected component is the delete_file() AJAX handler which takes a file path from the database and passes it to unlink() without validation (no realpath/basename/allowlist). Combined with ...
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...
WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash vulnerability
Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash vulnerability discovered by Endang Alfarisi in WordPress Plugin Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions = 1.9.0...
CVE-2026-17567
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
WordPress WPForms Pro plugin <= 1.10.1.1 - Unauthenticated Arbitrary File Write vulnerability
Unauthenticated Arbitrary File Write vulnerability discovered by lhking in WordPress Plugin WPForms Pro versions = 1.10.1.1...