CVE-2026-4406

Gravity Forms = 2.9.28 — Cross-Site Scripting Reflejado No Autenticado a través del Parámetro formids de gformgetconfig Resumen de la Vulnerabilidad "success":true,"data":"common":"form":"pagination":"":null "success":true,"data":"common":"form":"pagination":"":null,"":null...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: subida arbitraria de archivos sin autenticación → RCE CVSS 9.8 Crítico · Afectado: Forminator = 1.56.1 · Parcheado: 1.56.2 Investigador: daroo Wordfence Bug Bounty, $2,048 · 600k instalaciones activas Informe:...

cve-2026-94504

cve-2026-94504 POC de XSS almacenado no autenticado en Ninja Forms Ninja Forms ≤ 3.15.3 — XSS almacenado no autenticado. Se guarda un textarea público sin RTE, luego se aplica htmlentitydecode y se escribe en el editor de envíos heredado sin esctextarea. 3.15.4 lo escapa. No se requiere iniciar...

Flo-Forms-CVE-Report

Flo-Forms-CVE-Report Disclosure for CVE-2025-13159 CVE-2025-13159 - Vulnerability in Flo Forms – Easy Drag & Drop Form Builder This repository discloses a vulnerability discovered in Flo Forms – Easy Drag & Drop Form Builder = 1.0.43,WordPress plugin developed by flothemesplugins. 🛠 Affected...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

CVE-2026-3253

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

EUVD-2026-85854

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Adobe AEM Forms on JEE OGNL Injection to RCE 🔎 Overview CVE-2025-54253 is a critical OGNL injection vulnerability in Adobe AEM Forms on JEE. It allows unauthenticated attackers to execute arbitrary operating system commands via the /adminui/debug?debug=OGNL: endpoint. Severity:...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

nex-forms_SQL-Injection-CVE-2023-2114

nex-formsSQL-Injection CVE-2023-2114 https://vulners.com/cve/CVE-2023-2114 https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d Quick Review about the SQL-Injection in the NEX-Forms Plugin for WordPress Uploaded exploit Note that this uploaded exploit code isnt for this particula...

Xenotix-xBOT

Xenotix-xBOT Xenotix xBOT is a proof of concept cross platform Linux, Windows, Mac bot written in Python that abuse certain Google Services to implement Command & Control Center for the botnet. The Google Apps Data API, Google Forms and Google Spreadsheet is abused to implement C2 for a bot...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms This is a SudoWP security fork of the original Crowdsignal Forms plugin. !WARNING Security Notice : The original "Crowdsignal Forms" plugin versions = 1.7.2 contains a critical Missing Authorization vulnerability CVE-2025-69015 allowing authenticated users to modify polls...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: root@kitploit: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-...

CVE-2026-18467

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

Ninja Forms < 3.6.22 - Cross-Site Scripting

Ninja Forms before 3.6.22 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...