EUVD-2026-57736

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146

The CVE-2026-18146 entry concerns the Fluent Forms WordPress plugin (versions ≤ 6.2.11). It describes a Stored Cross‑Site Scripting vulnerability caused by insufficient input sanitization and output escaping in Notification Smartcode Values, enabling unauthenticated attackers to inject scripts th...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

PT-2026-71499

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

PT-2026-71556

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-13048: Improper Neutralization of Directives in Dynamically Evaluated Code

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-18146: Improper Neutralization of Input During Web Page Generation

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-27536: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2026-66444: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

PT-2026-71395

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

WordPress Fluent Forms Pro Add On Pack plugin 6.2.7 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.7...

WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-71852 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-71852 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-71870 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-71870 Source...

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhan Luo in WordPress Plugin Payment Forms for Paystack versions = 4.0.5...

CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...