CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210

FrontAccounting through 2.4.20 suffers from a Cross-Site Request Forgery (CSRF) flaw in its financial transaction forms. The application generates a CSRF token in end_form() (includes/ui/ui_controls.inc) and embeds it as the _token hidden field, but only admin/users.php and admin/change_current_u...

WordPress Forminator Forms plugin < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite vulnerability

Admin+ Network-Wide RCE via Hub Connector API Key on Multisite vulnerability discovered by Jakub Herman in WordPress Plugin Forminator versions 1.57.0.5...

CVE-2026-81276

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

CVE-2026-81276

CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...

EUVD-2026-66953

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

SUSE CVE-2026-79133

Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-81276: Missing Authorization

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

PT-2026-82472

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Kali Forms versions = 2.4.23...

SUSE CVE-2026-79287

Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79287

A flaw was found in chromium-browser. A remote attacker could exploit an observable discrepancy in Forms by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user...

CVE-2026-79133

A flaw was found in chromium-browser. A remote attacker could exploit an incorrect authorization vulnerability in the Forms component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user...

WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...

WordPress Forminator Forms plugin <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) vulnerability

Unauthenticated Stored Cross-Site Scripting via Radio Field Save and Continue Draft vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.2...

WordPress Forminator Forms plugin <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter vulnerability

Unauthenticated DOM-Based Cross-Site Scripting via 'errordescription' Parameter vulnerability discovered by Adrien Brunner in WordPress Plugin Forminator versions = 1.57.0...

CVE-2026-18331

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-77758

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...