CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

EUVD-2026-91175

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...

CVE-2025-6783

Inject an always-true condition into the WHERE clause so that every row matches: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0...

PT-2026-104081

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-104083

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file path,...

PT-2026-104077

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

PT-2026-104078

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before email success msg function, in its register login action='update' flow, trusting an...

CVE-2026-87796

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-87796 CVE-2026-87796 Multi Uploader for Gravity Forms 1.1.9 - sh1zen I am @abraxasnull. Loopback lab. The client is CVE-2026-87796-Abraxas-Labs.py. The advisory named a method. movefile is a private PHP...

CVE-2026-18351

CVE-2026-18351 Массовый эксплойт для CVE-2026-18351 — неаутентифицированная загрузка произвольных файлов → RCE в Drag and Drop File Upload for Elementor Forms credit johenlastgen | telegram @johenlastgen | channel @jlgnetworkredirect Возможности Пассивная проверка уязвимости без загрузки...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Неаутентифицированная произвольная загрузка файлов. Описание : Плагин Ninja Forms - File Uploads для WordPress уязвим к неаутентифицированной произвольной загрузке файлов из-за отсутствия проверки типа файлов и отсутствия проверки прав доступа в...

CVE-2026-0740

ninja.py Экспериментальный/инструментальный скрипт для WordPress-сайтов, использующий конечные точки загрузки файлов upload плагина Ninja Forms. Последовательно отправляет запросы к целям из list.txt, записывает успешные загрузки в файл shell.txt. Требования Python 3 requests обычно устанавливает...

WordPress Ninja Forms plugin <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission vulnerability

Unauthenticated Stored Cross-Site Scripting via Paragraph Text RTE Field Submission vulnerability discovered by UKO - Korea univ. in WordPress Plugin Ninja Forms versions = 3.15.4...

CVE-2026-1056-POC

CVE-2026-1056-POC Snow Monkey Forms — PoC неавторизованного удаления произвольных файлов Этот репозиторий содержит Proof of Concept PoC для критической уязвимости в плагине Snow Monkey Forms для WordPress версии send; // Direct execution flow to send // CSRF check is only performed for other...

CVE-2026-4406

Gravity Forms = 2.9.28 — Неаутентифицированный отражённый межсайтовый скриптинг через параметр formids в gformgetconfig Сводка об уязвимости Поле| Значение ---|--- Затронутое ПО| Gravity Forms плагин WordPress Вендор| Rocketgenius, Inc. Тип уязвимости| CWE-79: Некорректная нейтрализация входных...

WordPress Ninja Forms - File Uploads plugin <= 3.3.34 - Unauthenticated Arbitrary File Upload vulnerability

WordPress Ninja Forms - File Uploads plugin = 3.3.34 - Unauthenticated Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.34...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read vulnerability

Unauthenticated Path Traversal to Arbitrary File Read vulnerability discovered by afei in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: неаутентифицированная произвольная загрузка файлов → RCE CVSS 9.8 Critical · Затронуто: Forminator = 1.56.1 · Исправлено: 1.56.2 Исследователь: daroo Wordfence Bug Bounty, $2,048 · 600k активных установок Разбор:...