CVE-2026-111833

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

CVE-2026-111833 WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

CVE-2026-111833

The Bold Grid weForms WordPress plugin (versions

EUVD-2026-107277

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

PT-2026-120615

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Peter Tang in WordPress Plugin weForms versions = 1.6.28...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin is vulnerable to limited media file deletion in versions up to and including 1.6.28 . The root cause is insufficient file path validation within the weforms_delete_entry_attachments function. This allows unauthenticated atta...

CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

EUVD-2026-103278

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

WordPress weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin <= 1.6.28 - Unauthenticated Limited Media File Deletion vulnerability

Unauthenticated Limited Media File Deletion vulnerability discovered by Kuba in WordPress Plugin weForms versions = 1.6.28...

CVE-2026-110253: Improper Limitation of a Pathname to a Restricted Directory

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-32484

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...

CVE-2026-2707

The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are...

EUVD-2026-15828

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...

CVE-2026-32484

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...

CVE-2026-32484 WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...

CVE-2026-32484 WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...

CVE-2026-32484

Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through = 1.6.26...