CVE-2026-18467: Improper Privilege Management

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

PT-2026-98308

Alright, so I saw this Wordfence report from last week and honestly my jaw dropped. Nearly 50 plugins and themes dropped with active, unpatched vulnerabilities in a single week. That's not a normal week. That's a red flag waving right in our faces. And look, I get it. We all know the WordPress...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-84151: Improper Neutralization of Input During Web Page Generation

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

PT-2026-97785

Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms official plugin for WordPress versions prior to 1.7.22 Description An issue exists where a missing capability check in the forms method of the AdminController class allows authenticated users with Contributor-level...

CVE-2026-95515

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

CVE-2026-93773

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-95515 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

EUVD-2026-85490

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

CVE-2026-95515

The Ninja Forms WordPress plugin, version 3.15.3 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) . This vulnerability allows an attacker to execute malicious scripts in the context of the user's browser. No specific root cause, exploit links, or remediation steps are pr...

CVE-2026-93773

The Mollie Forms WordPress plugin (versions

EUVD-2026-85467

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-93773 WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-93773 WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

WordPress Paytium: Mollie payment forms & donations plugin <= 5.0.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin Paytium versions = 5.0.3...

vulnerabilities in Adobe Experience Manager Forms JEE

Adobe has identified 6 vulnerabilities in Adobe Experience Manager AEM Forms for Java Enterprise Edition JEE, including AEM 6.5 Forms and AEM 6.5 LTS Forms. These vulnerabilities concern various security issues, such as improper authorization, inadequate input validation, Server-Side Request...

CVE-2026-87071

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-87070

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Ninja Forms versions = 3.15.3...