CVE-2026-105260

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

PT-2022-12991

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.0.8 Description The issue allows attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks due to the lack of nonce checks. Recommendations...