WordPress Ninja Forms input validation error vulnerability

Versions of WordPress Ninja Forms prior to 3.15.4 contain an input validation error vulnerability. This flaw stems from incomplete server-side validation; unauthenticated attackers can submit arbitrary values via the nfajaxsubmit endpoint to Checkbox List, Multi-Select List, Image List, Country,...

CVE-2026-3241

In Concrete CMS below version 9.4.8, a stored cross-site scripting XSS vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms e.g., a rogue administrator can inject a persistent JavaScript payload into the options of a multiple-choice...

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

In Concrete CMS below version 9.4.8, a Cross-site Scripting XSS vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms e.g., a rogue administrator can inject a persistent JavaScript payload into the options of a multiple-choice question...