10937 matches found
CVE-2026-94573
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7 . The root cause is insufficient input sanitization and output escaping within the Repeater Field Value. This flaw allows unauthenticated attac...
CVE-2026-93656
The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...
EUVD-2026-86596
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...
Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)
The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...
PT-2026-98367
Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.120.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can permanently...
CVE-2026-94573: Improper Neutralization of Input During Web Page Generation
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
PT-2026-98397
Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...
cve-2026-94504
cve-2026-94504 Ninja Forms unauth stored XSS POC Ninja Forms ≤ 3.15.3 — unauthenticated stored XSS. A public non-RTE textarea is saved, then htmlentitydecode'd and written into the legacy submission editor with no esctextarea. 3.15.4 escapes it. No login is required to plant the payload. It runs...
CVE-2026-3253
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
EUVD-2026-85854
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
CVE-2026-3253
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...
CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass vulnerability
Unauthenticated Poll Vote Limit Bypass vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.57.2.1...
CVE-2026-18467
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
CVE-2026-18467
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation in versions up to and including 5.0.3 . The root cause is a logic flaw where the pt_cf_checkout_meta() filter copies $_POST['pt_form_field'][*] keys into the payment meta array...
EUVD-2026-85777
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
CVE-2026-18467 Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
CVE-2026-18467 Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
