CVE-2026-19513: Unrestricted Upload of File with Dangerous Type

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

CVE-2026-75964: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75965: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

PT-2026-84219

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3 Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the...

CVE-2026-81297

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81756

An unauthenticated SQL injection vulnerability exists in the WordPress plugin Smart Marketing SMS and Newsletters Forms in versions

EUVD-2026-68784

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

EUVD-2026-68781

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68782

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

CVE-2026-81296

CVE-2026-81296 affects the WordPress plugin Fluent Forms Pro Add On Pack (versions

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

MAL-2026-15636 Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...