CVE-2026-97661

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96813

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CVE-2026-100179

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x any URL parameter consumed by the form's calculated equation' parameter in all versions up to, and including,...

CVE-2026-97661

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96813

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CVE-2026-96573

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-100179

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x any URL parameter consumed by the form's calculated equation' parameter in all versions up to, and including,...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

cve-2026-3359-exp

CVE-2026-3359 is an unauthenticated SQL Injection vulnerability situated within Web10's wordpress plugin "Form Maker" in all versions up to version 1.15.42. In order to use this PoC/exploit, first set up a virtual enviroment through the commands "virtualenv name of your enviroment here" or "venv...

CVE-2026-103542

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103541

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103540

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90502

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542

A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...

CVE-2025-55182-GUI

CVE-2025-55182 Vulnerability Detection and Exploitation Tool GUI Version Project Overview This project is a graphical detection and exploitation tool targeting the high-risk CVE-2025-55182 vulnerability, developed with Python + tkinter to provide a fully graphical interface. It eliminates the nee...

EUVD-2026-90499

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

CVE-2026-103541

A vulnerability exists in formtools.org Form Tools up to version 3.1.1 . The flaw is located in the Ajax Handler component, specifically within the Files::uploadFile function of the global/code/actions.php file. This issue allows for unrestricted upload via a remote attack vector. While the proje...