CVE-2026-75961 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

VulnCheck KEV: CVE-2026-84434

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-75961: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Exploit for CVE-2026-87796

abraxaslabs.tech · github.com/abraxas ·&...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin NEX-Forms versions = 9.3.0...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin (versions 2.0.5–5.1.0 ) contains a missing authorization flaw in its message deletion AJAX action. The plugin checks only that a nonce parameter is present without validating it and does not verify the reques...

CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

EUVD-2026-81335

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 1.1.9 . The flaw resides in the move_file function in GFMU_FileUploader.php, where insufficient file type validation during chunked upload handling allo...

CVE-2026-87796: Unrestricted Upload of File with Dangerous Type

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-91010: Missing Authorization

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-92751

CMAK (Yahoo's Kafka management tool) through version 3.0.0.6 lacks a cross-site request forgery (CSRF) filter, enabling attackers to craft hidden forms that trigger state-changing actions on behalf of authenticated operators. Destructive endpoints such as topic deletion and cluster configuration ...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...

CVE-2026-19857

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

EUVD-2026-80218

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...