EUVD-2026-60570

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-60569

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-75091

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-28568: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-74004: Missing Authorization

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-66639: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-66633: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-32466: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-75091: Improper Neutralization of Input During Web Page Generation

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15748: Unrestricted Upload of File with Dangerous Type

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

PT-2026-76906

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-77035

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

PT-2026-77127

Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...

PT-2026-77061

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

PT-2026-77044

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

PT-2026-77067

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin

On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...

WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xVenus in WordPress Plugin Gravity Forms Bookings premium versions = 2.1...