CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425

Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.

CVE-2026-66425

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

EUVD-2026-53880

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

EUVD-2026-53970

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523

CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions

CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

Malicious code in @activepieces/piece-google-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...

MAL-2026-13396 Malicious code in @activepieces/piece-google-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...

WordPress Login & Register Forms plugin < 3.2.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Login/Signup Popup versions 3.2.5...

WordPress Mailmunch Forms for Mailchimp plugin <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ MailMunch Integration Takeover vulnerability discovered by t0ann9uy3n in WordPress Plugin MailChimp Forms by MailMunch versions = 3.2.7...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734 Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin versions before 8.5.2 is vulnerable to unauthenticated payment intent amount manipulation . The root cause is a lack of ownership verification for two specific AJAX actions: pricing-recalculation and payment-intent-update. While an ownershi...

EUVD-2026-53725

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...