CVE-2026-14870

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-14870 Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-14870: Improper Neutralization of Input During Web Page Generation

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Exploit for CVE-2026-10818

CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Ar...

CVE-2026-10818

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818

WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...

CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-10818: Unrestricted Upload of File with Dangerous Type

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

CVE-2026-57427

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

EUVD-2026-48169

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-14282 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...

CVE-2026-14282 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...

CVE-2026-14282

The CVE describes a vulnerability in the GoDAM WordPress plugin (versions up to and including 1.12.2) where an insufficient file type validation in save_video_file() (hooked to WPForms process) trusts the attacker-controlled Content-Type header, preserves the original filename via wp_unique_filen...

PT-2026-63827

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-14282: Unrestricted Upload of File with Dangerous Type

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...

CVE-2026-15782 WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...