CVE-2026-19860: External Control of File Name or Path

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary...

CVE-2026-13770: Improper Neutralization of Input During Web Page Generation

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

PT-2026-95772

Name of the Vulnerable Software and Affected Versions PDF Builder for WooCommerce. Create invoices,packing slips and more versions prior to 2.0.12 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

PT-2026-95784

Name of the Vulnerable Software and Affected Versions Ibtana – Ecommerce Product Addons versions prior to 0.4.7.8 Description Authenticated users with Subscriber-level access and above can perform unauthorized post meta modification. This is caused by a missing capability check on the 'iepa use g...

PT-2026-95751

Name of the Vulnerable Software and Affected Versions Nimble Page Builder WordPress plugin versions prior to 3.3.9 Description An authorization check is missing when returning page-builder content through an authenticated AJAX action. This allows any authenticated user with Subscriber level...

CVE-2026-16557: Exposure of Sensitive Information to an Unauthorized Actor

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...

CVE-2026-92229: Improper Control of Generation of Code

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

PT-2026-95752

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.3 Description Insufficient restriction of PHP functions used as custom field-validation callbacks allows users with form management privileges to trigger the...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

WordPress PDF Builder for WooCommerce. Create invoices,packing slips and more plugin <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Invoice Data Disclosure vulnerability discovered by Jaskaranjeet Singh in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.11...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-63374 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

WordPress Form Builder CP plugin < 1.2.47 - Editor+ Stored XSS via form_structure vulnerability

Editor+ Stored XSS via formstructure vulnerability discovered by Luca Jungnickel in WordPress Plugin Form Builder CP versions 1.2.47...

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Stored XSS vulnerability

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Stored XSS vulnerability discovered by Civitasmass in WordPress Plugin Easy Form Builder versions 4.0.0-4.1.3...

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Registration Policy Bypass vulnerability

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Registration Policy Bypass vulnerability discovered by Artus KG in WordPress Plugin Easy Form Builder versions 4.0.0-4.1.3...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

CVE-2026-14472

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...