CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin is vulnerable to limited media file deletion in versions up to and including 1.6.28 . The root cause is insufficient file path validation within the weforms_delete_entry_attachments function. This allows unauthenticated atta...

CVE-2026-5127

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuffiles...

WordPress plugin User Frontend code issue vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2026-5127: Deserialization of Untrusted Data

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuffiles...