EUVD-2026-46160

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

CVE-2026-13694 Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-13693 Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

EUVD-2026-46161

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-13693

The CVE describes a path-traversal in the Bit Form WordPress plugin (affected: before 3.1.0) where a form file-field value is not restricted to a safe path before reading and attaching to a notification email, allowing unauthenticated attackers to read arbitrary server files (e.g., WordPress conf...

CVE-2026-11767

The CVE-2026-11767 entry describes a Stored XSS vulnerability in The Free Builder for Elementor WordPress plugin, affecting versions before 1.6.7. The issue arises from insufficient sanitization of submitted contact form field values, which are stored and later output in the admin dashboard, enab...

CVE-2026-13694

CVE-2026-13694 affects the Bit Form WordPress plugin prior to 3.1.0. The root cause is improper validation of the workflow-trigger token after its transient expires, enabling unauthenticated attackers to re-trigger configured workflow actions (e.g., notification emails and integrations). Document...

CVE-2026-11767 CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

EUVD-2026-46155

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

GHSA-HCPX-6FM6-WX23 Axios form serializer maxDepth bypass via {} metatoken

Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending in , axios calls JSON.stringify on that value before the formSerializer.maxDepth guard can inspect...

CVE-2026-60027

Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read...

Tornado: Quadratic DoS via Crafted Multipart Parameters

Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...

CVE-2026-60027 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read...

EUVD-2026-46063

The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...

CVE-2026-60027

The CVE concerns the Joomla extension Quix Page Builder Pro (pre-6.2.1 per CVE listing) and describes an unauthenticated path traversal vulnerability via form elements. An unauthenticated frontend user can traverse paths and read arbitrary files, requiring a published page containing a Form eleme...

GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...