CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-100304

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

CVE-2026-100304

TDuck survey form 6.0 is vulnerable to an information disclosure vulnerability within the FormAuthUtils.hasPermission component. The issue stems from a fail-open mechanism that occurs when a form no longer exists. This allows authenticated users to access deleted form submissions by providing a k...

CVE-2026-100304: Not Failing Securely

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

GHSA-584P-F93J-WPGC Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Impact The anonymous front-end action formie/submissions/submit SubmissionsController::actionSubmit trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the formie/submissions/submit action. An attacker can overwrite or hijack another user's incomplete submission by supplying a crafted submissionId parameter without proper session binding, ownership validation,...

DRUPAL-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

PT-2026-97672

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

PT-2026-97501

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description The anonymous endpoint 'formie/submissions/submit' in the SubmissionsController::actionSubmit function trusts a client-supplied submissionId when loading incomplete...

CVE-2026-92438 Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

Wordfence Bug Bounty Program Monthly Report – May 2026

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

CVE-2026-18594

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...