CVE-2026-103999 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-103999

The Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.54 . The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Attackers...

CVE-2026-110017 Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-110017

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.0.4 . The root cause is insufficient input sanitization and output escaping within the 'form' parameter of a shortcode attribute. An authe...

EUVD-2026-102659

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CLEANSTART-2026-TE73815 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

EUVD-2026-102501

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import t...

EUVD-2026-102469

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...

CVE-2026-105973: Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

PT-2026-115432

Name of the Vulnerable Software and Affected Versions MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. versions prior to 1.2.78.7 Description An unauthenticated privilege escalation issue exists because the subscribe to email list endpoint accepts an...

CVE-2026-103999: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

PT-2026-115611

Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An input neutralization issue in the Webhook URL form field component allows a remote, authenticated attacker to execute stored Cross-Site Scripting XSS by providing malicious input...

PT-2026-115445

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.55 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping during file uploads. Unauthenticated attackers can inject arbitrary web...

PT-2026-115468

Name of the Vulnerable Software and Affected Versions Visual Form Builder versions prior to 3.2 Description The plugin fails to perform authorization or nonce checks when reordering form fields. This allows any authenticated user with the Subscriber role or higher to modify the field structure of...

PT-2026-116020

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

PT-2026-115525

Name of the Vulnerable Software and Affected Versions Social Share Buttons versions prior to 1.31 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the share...

PT-2026-115455

Name of the Vulnerable Software and Affected Versions Quick PayPal Payments: Payment Button & Form versions prior to 6.0.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can...

CVE-2026-110017: Improper Neutralization of Input During Web Page Generation

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-105974: Exposure of Sensitive Information to an Unauthorized Actor

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-111621: Authorization Bypass Through User-Controlled Key

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...