33353 matches found
CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-66660
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
CVE-2026-28184
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-57962
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
CVE-2026-28184
This CVE ID is rejected and not an active vulnerability entry.
CVE-2026-19484
@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...
CVE-2026-19481
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...
PT-2026-71585
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-19481: Improper Check for Unusual or Exceptional Conditions
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...
CVE-2026-13051: Improper Neutralization of Special Elements Used in a Template Engine
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...
CVE-2026-66660: Missing Authorization
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
PT-2026-71695
Name of the Vulnerable Software and Affected Versions Form::Processor::Field::HtmlArea versions 0.06 through 1.162360 Description An issue exists where the validate function processes submitted markup using HTML::Tidy and passes the resulting messages to the add error function. These messages are...
PT-2026-71528
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
CVE-2026-18146: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...
CVE-2026-28184: Undefined Security Weakness
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
