CVE-2026-14318

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

EUVD-2026-51005

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

EUVD-2026-50999

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15255 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

WordPress RegistrationMagic plugin < 6.0.9.4 - Unauthenticated Form Submission Disclosure vulnerability

Unauthenticated Form Submission Disclosure vulnerability discovered by Jonatan Buskila in WordPress Plugin RegistrationMagic versions 6.0.9.4...

CVE-2026-15255 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15255

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15257

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15257

The RegistrationMagic WordPress plugin (versions before 6.0.9.4 ) is vulnerable to an authorization bypass because it fails to perform authorization , ownership , or nonce checks on a front-end submission-editing action. This flaw allows unauthenticated attackers to overwrite form submissions bel...

CVE-2026-15257 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

WordPress RegistrationMagic plugin < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification vulnerability

Unauthenticated Form Submission and User Profile Modification vulnerability discovered by Jonatan Buskila in WordPress Plugin RegistrationMagic versions 6.0.9.4...

CVE-2026-15257 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15255

The RegistrationMagic WordPress plugin (versions before 6.0.9.4 ) is vulnerable to an unauthenticated form submission disclosure via IDOR . The root cause is a failure to properly validate that a one-time password provided in a cookie corresponds to the specific identity being requested. This all...

EUVD-2026-50995

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318

The GiveWP WordPress plugin, in versions prior to 4.16.3 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from a failure to escape a donation-form template setting before it is outputted into an HTML attribute. This allows authenticated users with the GiveWP Worker rol...