PT-2026-96651

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attacke...

PT-2026-96990

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where a high-privileged attacker can inject malicious scripts into vulnerable form fields. When a victim visits the...

CVE-2026-75744: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

PT-2026-96989

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description Cross-Site Request Forgery CSRF is a flaw where a victim is tricked into performing actions they did not intend to do. This issue allows an attacker to bypass...

APSB26-151 : Security updates available for Adobe Experience Manager (AEM) Forms

Adobe has released a security update for Adobe Experience Manager Forms on Java Enterprise Edition JEE. This update addresses critical vulnerabilities that could result in arbitrary code execution, privilege escalation, and security feature bypass. Adobe is not aware of any exploits in the wild f...

CVE-2026-82000: Server-Side Request Forgery (SSRF)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

Malicious Package

Overview tailwindcss-forms-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Exploit for CVE-2026-14894

CVE-2026-14894 Arbitrary File Upload Nxploited Mass Exploi...

VulnCheck KEV: CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-87067

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87067

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to Authenticated Remote Code Execution (RCE) via PHP Object Injection . The flaw exists because the plugin fails to restrict which classes can be instantiated during the deserialization of values received from an XML-...

CVE-2026-87068

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to an Authenticated Privilege Escalation flaw. The issue occurs because the plugin fails to apply consistent role validation when a registration form is nested inside an imported quiz. An attacker with permissions to ...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

EUVD-2026-83670

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87067: Improper Control of Generation of Code

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...