CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-53704

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18325

CVE-2026-18325 affects Forminator Forms for WordPress, specifically versions

CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-68401

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.2 Description An issue exists where the plugin fails to verify if the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions. This allows an...

PT-2026-68636

Name of the Vulnerable Software and Affected Versions Formidable Forms WordPress plugin versions prior to 6.32.1 Description Insufficient validation of PayPal subscription payment status allows unauthenticated users to bypass payment processes. This enables the triggering of paid form actions,...

PT-2026-68654

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

PT-2026-68374

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.56.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a techniqu...

CVE-2026-15256: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-11361: Insufficient Verification of Data Authenticity

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...

CVE-2026-66425: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-65523: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-16734: Missing Authorization

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-18325: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-68570

Name of the Vulnerable Software and Affected Versions Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions prior to 1.9.1 Description Broken authentication allows unauthenticated users to bypass security controls within the plugin. Recommendation...

PT-2026-68978

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

CVE-2026-71434: Unrestricted Upload of File with Dangerous Type

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

PT-2026-68802

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2 Description Public frontend forms fail to enforce the file upload restrictions configured in the Control Panel. This allows an unauthenticated visitor to upload file types tha...

MAL-2026-13024 Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...