CVE-2026-1674: Missing Authorization

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the savegutenaformsschema function in all versions up to, and including, 1.6.0. This makes...

WordPress plugin Gutena Forms 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-22899

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save gutena forms schema function in all versions up to, and including, 1.6.0. This...

WordPress Gutena Forms - Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() vulnerability

WordPress Gutena Forms - Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin = 1.6.0 - Authenticated Contributor+ Limited Options Update in savegutenaformsschema vulnerability discovered by Youssef Elouaer in WordPress Plugin Gutena Forms – Contact Form, Survey...

OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Summary In openclaw up to and including 2026.2.23 latest npm release as of February 25, 2026, system.run shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime. Affected Packages / Versions - Package: opencl...

CVE-2026-2568

CVE-2026-2568 is an authenticated storage-XSS in the WordPress plugin pair “WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms” (slug cf7-zendesk) affecting versions up to 1.1.5. Public sources (Wordfence) confirm this is a stored XSS via form submission data, with CVSS...

CVE-2026-2568 WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possib...

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions = 1.1.5...

Malicious code in tailwindcss-forms-animation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5581b4e4ac6d5e02fe8dd2de23b1267ad2ac1b40a0c5be4cd284af8c6979588 The package tailwindcss-forms-animation was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1210 Malicious code in tailwindcss-forms-animation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5581b4e4ac6d5e02fe8dd2de23b1267ad2ac1b40a0c5be4cd284af8c6979588 The package tailwindcss-forms-animation was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview tailwindcss-forms-animation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in tailwindcss-forms-componentes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0825512b6509f2725c98e651bd2d86e9fd2fa6e488f9ee33a7cdcfbf30b1a73e The package tailwindcss-forms-componentes was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwindcss-forms-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a402948dc389c4a201ac4271a843d78a5131d377a3904fe178b51c6aef5adb The package tailwindcss-forms-component was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview tailwindcss-forms-componentes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tailwindcss-forms-component is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-1212 Malicious code in tailwindcss-forms-componentes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0825512b6509f2725c98e651bd2d86e9fd2fa6e488f9ee33a7cdcfbf30b1a73e The package tailwindcss-forms-componentes was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1211 Malicious code in tailwindcss-forms-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a402948dc389c4a201ac4271a843d78a5131d377a3904fe178b51c6aef5adb The package tailwindcss-forms-component was found to contain malicious code. Source: ghsa-malware...

CVE-2026-2568: Improper Neutralization of Input During Web Page Generation

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-2428

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN Instant Payment Notification verification being disabled by default disableipnverification defaults to...

CVE-2026-2471

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...