CVE-2026-45118

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-45118

MyBB's contact.php passes unvalidated from parameter or Referer header to redirect() without protocol checks, allowing a javascript: URI to become a clickable link that executes script when a victim clicks it. No public exploitation evidence is available. Upgrade to MyBB 1.8.40 to fix.

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-73379 WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

EUVD-2026-60794

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73379

Affected component: Contact Form by Supsystic plugin for WordPress, versions before 1.10.0. Vulnerability type: Unauthenticated bypass, allowing network-accessible attackers to circumvent access controls without credentials. CVSS 3.1: 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Exploitation...

CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

EUVD-2026-60793

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-66639

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

EUVD-2026-60924

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-32472 WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32472

CVE-2026-32472 is an unauthenticated Broken Access Control vulnerability in the WordPress Online Contact Widget plugin, affecting versions ≤ 1.3.0 . The flaw allows an unauthenticated attacker to access data they should not be able to, resulting in high confidentiality impact with no integrity or...

EUVD-2026-60906

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.7...