MAL-2026-12133 Malicious code in accounts-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed On require of accounts-forms, index.js loads polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcod...

Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

MAL-2026-12221 Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...

Malicious code in pfp-forms-insurance-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96 On require'pfp-forms-insurance-health', index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloa...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...

EUVD-2026-53170

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-5581

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-5581 Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-5581

The CVE-2026-5581 entry concerns the WordPress plugin Multi Uploader for Gravity Forms . It is vulnerable in all versions up to and including 1.1.8 due to missing capability checks in the function plupload_ajax_delete_file() , which is registered via wp_ajax_nopriv_gfmu_delete_file . The CSRF-pro...

CVE-2026-7520: Missing Authorization

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-5581: Missing Authorization

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

PT-2026-68083

Name of the Vulnerable Software and Affected Versions MailChimp Forms by MailMunch versions prior to 3.2.8 Description The plugin is susceptible to unauthorized data modification because the sign in and sign up AJAX handlers lack proper capability checks. Authenticated users with Subscriber-level...

VulnCheck KEV: CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

PT-2026-68025

Name of the Vulnerable Software and Affected Versions Multi Uploader for Gravity Forms versions prior to 1.1.9 Description Unauthenticated attackers can permanently delete any WordPress media attachment by providing its attachment ID. This issue occurs because the plupload ajax delete file...

PT-2026-68020

Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension versions prior to 5.0.6 Description Stored Cross-Site Scripting occurs due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

Improper handling of case sensitivity allows privilege escalation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently. While the canonical ID for a case-insensitive user or group name is created by lowercasing the name, comparisons of user names and group names are done using...