11442 matches found
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...
CVE-2026-15663
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
EUVD-2026-48549
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-15663 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-15663
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-15663
The CVE covers Ninja Forms – The Contact Form Builder for WordPress, affected up to version 3.14.9. The vulnerability is a generic SQL Injection in the Import File settings key, caused by insufficient escaping and lack of parameterization in the call chain. Two sinks are implicated: _save_setting...
CVE-2026-14603
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...
CVE-2026-14603 WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...
CVE-2026-14603 WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...
CVE-2026-14603
The WowOptin: Next-Gen Popup Maker WordPress plugin (versions before 1.4.38 ) is vulnerable to an improper access control flaw on a REST endpoint . This lack of proper authorization allows unauthenticated users to perform unauthorized actions, specifically the ability to disable all opt-in forms ...
EUVD-2026-48494
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...
PT-2026-64474
Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 1.10.1.2 Description An arbitrary file upload issue exists in the ajax chunk upload finalize function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are writt...
PT-2026-64272
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-15663: Improper Neutralization of Special Elements used in an SQL Command
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
ROS-20260724-73-0009
The vulnerability of Google Chrome’s Forms component is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
PT-2026-64244
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.9 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Ninja Forms versions = 3.14.9...
CVE-2026-61947
Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...