CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...

CVE-2026-1056-POC

CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitrary File Deletion PoC This repository contains a Proof of Concept PoC for a critical vulnerability in the Snow Monkey Forms WordPress plugin versions send; // Direct execution flow to send // CSRF check is only performed for other method...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE

Exploit Author: Abdualhadi Khalifa https://x.com/absholi7ly Version: Elementor Pro = 4.2.1 Tested on: WordPress + Elementor Pro 4.2.1 Windows / Laragon / Apache CVE: CVE-2026-32475 Credits: Vulnerability discovered by Tin Pham TF1T via Patchstack Bug Bounty Program Category: WebApps Description:...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "erro...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL,...

CVE-2023-37979

CVE-2023-37979 Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions. PoC and Checker , for educational purposes only 'python3 exploit.py https://target.com'...

CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

CVE-2026-4406

Gravity Forms = 2.9.28 — Unauthenticated Reflected Cross-Site Scripting via gformgetconfig formids Parameter Vulnerability Summary Field| Value ---|--- Affected Software| Gravity Forms WordPress Plugin Vendor| Rocketgenius, Inc. Vulnerability Type| CWE-79: Improper Neutralization of Input During...

CVE-2026-0740

ninja.py An experimental/tool script that uses file upload endpoints for the Ninja Forms plugin on WordPress sites. It sends requests sequentially to targets in list.txt and writes successful uploads to the shell.txt file. Requirements Python 3 requests usually installed together with urllib3 pip...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Attack Vectors: Scripting A vulnerability in the sanitization of t...

Malicious code in @eforms/forms-api (npm)

Source: ossf-package-analysis cbe6ac9c18c859c04807fb2bd866f2eda2b70a4aa2583096b7138ab2adc90540 The OpenSSF Package Analysis project identified '@eforms/forms-api' @ 2.0.0-SNAPSHOT npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-18252 Malicious code in @eforms/forms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e58d3810346fb211fd7ed78e8df88c774a79bb079537e10cd30baa26e5ef4740 The npm package @eforms/[email protected] is a scoped-name dependency-confusion lure with an inflated version number and an empty index.js stub. Its...

Malicious code in @eforms/forms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e58d3810346fb211fd7ed78e8df88c774a79bb079537e10cd30baa26e5ef4740 The npm package @eforms/[email protected] is a scoped-name dependency-confusion lure with an inflated version number and an empty index.js stub. Its...

CVE-2026-115183

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

EUVD-2026-109351

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

CVE-2026-111976

The GiveWP WordPress plugin before version 4.19.0.1 is vulnerable to an unauthenticated information disclosure flaw. The plugin fails to perform necessary status or capability checks when rendering a donation form on a public front-end route. This allows unauthenticated visitors to view the conte...

CVE-2026-111976 GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished draft, pending, private and scheduled donation forms that...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...