EUVD-2026-83574

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664

Quill Forms (Conversational Multi Step Forms, Surveys & Quizzes) for WordPress is affected by a stored cross-site scripting vulnerability in all versions up to and including 5.7.1 . The flaw stems from insufficient input sanitization and output escaping in the Multiple Choice "Other" field . An u...

CVE-2026-15664 Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664 Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-84434

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

EUVD-2026-83473

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229

The Forminator Forms plugin for WordPress (versions ≤ 1.57.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the improper validation of the current_url POST parameter (specifically during quiz AJAX actions such as forminator_submit_form_quizzes), which is refl...

EUVD-2026-83472

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

CVE-2026-84434

Gravity Forms (WordPress plugin) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 3.1.0.4 . The root cause is a mismatch between the field validation pipeline and the file persistence pipeline: hidden file upload fields bypass extension validation, and a ...

CVE-2026-15664: Improper Neutralization of Input During Web Page Generation

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-84434: Unrestricted Upload of File with Dangerous Type

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the uploadfile function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass...

PT-2026-95738

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.1 Description An arbitrary file upload issue exists in the Gravity Forms plugin for WordPress via the upload file function. The flaw stems from a mismatch between the field validation pipeline and the file...

PT-2026-95780

Name of the Vulnerable Software and Affected Versions Quill Forms | Conversational Multi Step Forms, Surveys & quizzes versions prior to 5.7.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...

PT-2026-95746

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the...

CVE-2026-92229: Improper Control of Generation of Code

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...