11436 matches found
Malicious Package
Overview tailwindcss-forms-style is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
PT-2026-84219
Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3 Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the...
CVE-2026-19513: Unrestricted Upload of File with Dangerous Type
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...
CVE-2026-75964: Improper Neutralization of Input During Web Page Generation
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-75965: Improper Neutralization of Input During Web Page Generation
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
CVE-2026-81296
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
CVE-2026-81297
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
EUVD-2026-68784
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
CVE-2026-81756
An unauthenticated SQL injection vulnerability exists in the WordPress plugin Smart Marketing SMS and Newsletters Forms in versions
CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
EUVD-2026-68782
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...
EUVD-2026-68781
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-81297
Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...