CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-27536: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2026-66444: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-18146: Improper Neutralization of Input During Web Page Generation

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

PT-2026-71499

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

PT-2026-71556

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-13048: Improper Neutralization of Directives in Dynamically Evaluated Code

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

PT-2026-71395

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

WordPress Fluent Forms Pro Add On Pack plugin 6.2.7 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.7...

WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhan Luo in WordPress Plugin Payment Forms for Paystack versions = 4.0.5...

CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18470

The Login & Register Forms WordPress plugin (versions before 4.0.2 ) is vulnerable to unauthenticated email address disclosure . The root cause is a failure to verify that password reset requests originate from the actual account owner, combined with inadequate redaction of the response address. ...

CVE-2026-18468

The Login & Register Forms WordPress plugin, in versions prior to 4.0.2 , is vulnerable to an unauthenticated account takeover . The root cause is that the plugin fails to bind the password reset verification state to the specific account being reset or the party completing the verification; inst...

CVE-2026-18470 Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

CVE-2026-18468 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...