CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database The Industry-Standard Vulnerability Database for 0days, PoCs, and Threat Intelligence Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 About SecureWithUmer/Exploit-Index is the world's premier, zero-API...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

EUVD-2026-91915

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

WordPress Visual Form Builder <3.0.8 - Information Disclosure

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...

Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE

The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the doimageupload AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to a Directory Traversal vulnerability in all versions up to and including 6.3.316 . The root cause lies in the parse_request function, specifically involving the 'sfgtfi' URL path parameter. This flaw allows unauthenti...

EUVD-2026-91180

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-15896 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Privilege Escalation . The flaw exists in the Register & Login add-on's before_email_success_msg() function, which fails to perform ownership or capability checks when proc...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-15897 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-15897 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

PT-2026-104078

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before email success msg function, in its register login action='update' flow, trusting an...

PT-2026-104077

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...