CVE-2026-18328: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18100: Improper Neutralization of Input During Web Page Generation

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-4703: Deserialization of Untrusted Data

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin = 1.8.5 - Unauthenticated PHP Object Injection vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.8.5...

WordPress Royal Addons for Elementor plugin <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting vulnerability

Authenticated Contributor+ Server-Side Request Forgery via Form Builder Widget 'webhookurl' Setting vulnerability discovered by TarPeg007 - Independent Security Researcher in WordPress Plugin Royal Elementor Addons versions = 1.7.1064...

CVE-2026-17123

The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2024-13784: Deserialization of Untrusted Data

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-12998: Authorization Bypass Through User-Controlled Key

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-17123: Server-Side Request Forgery (SSRF)

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-13167: Missing Authorization

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-18146: Improper Neutralization of Input During Web Page Generation

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

EUVD-2026-53880

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425

Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.

CVE-2026-66425

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2025-15028: Improper Neutralization of Input During Web Page Generation

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

WordPress MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by she11f in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

WordPress Contact Form Builder, Contact Widget plugin <= 1.6.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Milad karimi in WordPress Plugin Contact Form Builder, Contact Widget versions = 1.6.1...