CVE-2026-124018

The Gutenverse Form plugin for WordPress (versions before 3.2.2 ) is vulnerable to a CSV formula injection flaw. The root cause is the use of sanitize_text_field() on the public form-submit REST route, which fails to strip formula-triggering characters such as =, +, @, or a leading minus. An unau...

CVE-2026-124018 Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with...

WordPress Mail Mint CVE-2026-10196 POP RCE

CVE-2026-10196 Mail Mint ≤ 1.31.0: unauthenticated mint-form-submit stores a serialized PostHog ForkCurl object; maybeunserialize triggers exec via curl host injection. Requires public wprest nonce from a page with Mail Mint form. !/usr/bin/env python3 -- coding: utf-8 -- """Mail Mint WordPress...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

EUVD-2026-109800

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

Mautic is affected by an Open Redirect vulnerability in the public form submission endpoint (PLATFORM_ENDPOINT ). The application fails to validate that the return address provided during form submission points to a trusted host. Consequently, an unauthenticated attacker can craft a form that red...

PT-2026-123316

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

PT-2026-118501

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 Description The form submission endpoint '/api/v1/@apostrophecms/form/submit' processes unbounded multipart uploads using the multer function before performing authentication, API-key verification, or...

PT-2026-104336

Name of the Vulnerable Software and Affected Versions Divi Membership versions prior to 2.2.1 Description An issue exists in the dmem form submit handler function that allows unauthenticated attackers to escalate privileges. The function determines a new user's role by iterating through all...

Exploit for CVE-2026-84753

abraxaslabs.tech · github.com/abraxas ·&...

MAL-2026-4683 Malicious code in tax4all-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 411707aa243c516b714830da4805c4abacaa4d5f7e2e8959773cd93468dd78aa The exported ContactForm Vue component in deploy/dist/index.js hardcodes form submissions to https://formsubmit.co/ajax/[email protected] — the...

CVE-2026-2881 D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub_425FF8 stack-based overflow

A vulnerability has been found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub425FF8 of the file /boafrm/formFirewallAdv of the component Advanced Firewall Configuration Endpoint. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack...

CVE-2021-47820 Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)

Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a malicious webpage that automatically submits a form to change router remote access settings to port 8080 without the user's consent...

CVE-2025-14465

The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the sabsoptionspageformsubmit function. This makes it possible for unauthenticated attackers to update plug...

WordPress plugin Sticky Action Buttons has a vulnerability related to cross-site request forgeing.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...

CVE-2025-13159 Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint floformsubmit without proper...