WordPress Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin 2.0.5-5.1.0 - Subscriber+ Arbitrary Form Submission Deletion vulnerability

Subscriber+ Arbitrary Form Submission Deletion vulnerability discovered by JunHee CHO in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions 2.0.5-5.1.0...

CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-44199

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to f...

EUVD-2022-6659

Malicious code in bioql PyPI...

WordPress Forminator Plugin CVE-2019-9568

Description The action of deleting submissions is vulnerable to blind SQL injection. An attacker can exploit this to extract data from the database. An account with the permission to delete submissions is required. Proof of Concept View submissions, eg at...

CVE-2013-4230: Undefined Security Weakness

The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...