PT-2026-4593

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without...

CVE-2026-0633: Improper Authentication

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without...

WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin MetForm Pro versions = 3.9.1...

CVE-2025-14059

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the createtemplate REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed...

EUVD-2023-12718

Malicious code in bioql PyPI...

EUVD-2023-12738

Malicious code in bioql PyPI...

EUVD-2023-12719

Malicious code in bioql PyPI...

EUVD-2023-12737

Malicious code in bioql PyPI...

EUVD-2023-12722

Malicious code in bioql PyPI...

EUVD-2023-12720

Malicious code in bioql PyPI...

EUVD-2023-12723

Malicious code in bioql PyPI...

EUVD-2023-55636

Malicious code in bioql PyPI...

EUVD-2023-12749

Malicious code in bioql PyPI...

EUVD-2024-31307

Malicious code in bioql PyPI...

EUVD-2025-8309

Malicious code in bioql PyPI...

EUVD-2025-23038

Malicious code in bioql PyPI...

EUVD-2024-17329

Malicious code in bioql PyPI...

EUVD-2024-27735

Malicious code in bioql PyPI...

CVE-2025-5684

CVE-2025-5684 : MetForm – WordPress plugin vulnerable to Stored Cross-Site Scripting via the mf-template DOM element in all versions up to and including 4.0.1. An authenticated attacker with Contributor-level access or higher can inject scripts executed by users on injected pages. Public sources ...

CVE-2025-5684 MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mf-template DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it...