WordPress Visual Form Builder <3.0.8 - Information Disclosure

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...

CVE-2026-105974

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-105973

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

CVE-2026-105973 Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

CVE-2026-105974

The Visual Form Builder WordPress plugin (versions through 3.1 ) is vulnerable to a sensitive data disclosure flaw. The plugin fails to perform an authorization check before displaying recent form submission data within a dashboard widget . This allows any authenticated user with Subscriber privi...

WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Arbitrary Form Field Reordering vulnerability

Subscriber+ Arbitrary Form Field Reordering vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Visual Form Builder versions = 3.1...

EUVD-2026-102688

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

EUVD-2026-102689

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Het Kalariya in WordPress Plugin Visual Form Builder versions = 3.1...

CVE-2026-105974 Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-105973 Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

CVE-2026-105973

The Visual Form Builder WordPress plugin (versions

CVE-2026-105974 Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-105974: Exposure of Sensitive Information to an Unauthorized Actor

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-105973: Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

PT-2026-115468

Name of the Vulnerable Software and Affected Versions Visual Form Builder versions prior to 3.2 Description The plugin fails to perform authorization or nonce checks when reordering form fields. This allows any authenticated user with the Subscriber role or higher to modify the field structure of...

PT-2026-115469

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.2 Description The plugin fails to perform an authorization check before displaying recent form submission data within a dashboard widget. This allows any authenticated user with the...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

CVE-2022-0142

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2022-0141

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks...