Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...

WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...

PT-2026-84009

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81756: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

PT-2026-84007

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

CVE-2026-81296: Missing Authorization

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

Forms Component Google Chrome Microsoft Edge Data Access Data Compromise

The vulnerability of the Forms component in Google Chrome and Microsoft Edge browsers is related to improper protection against attacks via external physical channels. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data...

Joomla com_baforms Code Execution

The vulnerability of the combaforms component of the Balbooa Forms extension in the Joomla content management system involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

EUVD-2026-68094

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2026-14494

CVE-2026-14494 is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in the Sigma Forms Pro plugin for WordPress, affecting all versions up to and including 1.4.5 . The flaw resides in the handle_form_submission function, which dynamically grants the unfiltered_upload capab...

CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability

Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin, in versions before 8.5.5 , is vulnerable to a cross-customer subscription cancellation via an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a subscription belongs to the customer associated with the active custome...

PT-2026-83424

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle form submission function. This is due to the plugin dynamically granting the unfiltered upload capability to all users during form submissions and bypassing...

CVE-2026-14494: Unrestricted Upload of File with Dangerous Type

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...