Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,922 results · page 14 of 59
Apr 23, 2026FunnelFormsPro: Improper Control of Generation of Code ('Code Injection')CVE-2026-39440 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.
- Product
- FunnelFormsPro
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update FunnelFormsPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 21, 2026Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.CVE-2026-33813 · Other software · golang.org/x/image · reported by security@golang.orgHigh 7.5
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
- Product
- golang.org/x/image/webp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter.CVE-2026-38835 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in CVE-2026-29642 · Other software · reported by MITREHigh 7.8
A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as "writes preserve values, reads ignore values," i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.riscv.orgdocs.riscv.org
Apr 20, 2026Everest Forms: Arbitrary File Read and DeletionCVE-2026-5478 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate server-side upload state, and converting attacker-supplied URLs into local filesystem paths using regex-based string replacement without canonicalization or directory boundary enforcement. This makes it possible for unauthenticated attackers to read arbitrary local files (e.g., wp-config.php) by injecting path-traversal payloads into the old_files upload field parameter, which are then attached to notification emails. The same path resolution is also used in the post-email cleanup routine, which calls unlink() on the resolved path, resulting in the targeted file being deleted after being attached. This can lead to full site compromise through disclosure of database credentials and authentication salts from wp-config.php, and denial of service through deletion of critical files. Prerequisite: The form must contain a file-upload or image-upload field, and disable storing entry information.
- Product
- Everest Forms
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 20, 2026When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations onCVE-2026-5958 · Other software · GNU · reported by cvd@cert.plLow 2.1
When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process. This issue was fixed in version 4.10.
- Product
- Sed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Insecure Direct Object ReferenceCVE-2026-4160 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'submission_id' parameter in versions up to, and including, 6.1.21. This is due to missing authorization and ownership validation on a user controlled key in the Stripe SCA confirmation AJAX endpoint. This makes it possible for unauthenticated attackers to modify payment status of targeted pending submissions (for example, setting the status to "failed").
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- up to 6.1.21
- What to do
- Affects up to 6.1.21. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 15, 2026Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.CVE-2026-6316 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Apr 15, 2026Contact Form by WPForms: Cross-Site Request Forgery (CSRF)CVE-2026-40764 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
- Product
- Contact Form by WPForms
- Affected
- up to 1.10.0.2
- What to do
- Affects up to 1.10.0.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 14, 2026A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adoCVE-2025-7389 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.2
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
- Product
- OpenEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Apr 13, 2026An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that eCVE-2026-0234 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.2
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
- Product
- Cortex XSOAR Microsoft Teams Marketplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Apr 9, 2026OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final CVE-2026-35637 · Other software · OpenClaw · reported by VulnCheckMedium 6.9
OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation.CVE-2026-35627 · Other software · OpenClaw · reported by VulnCheckMedium 6.9
OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted DM messages, enabling denial of service through resource exhaustion.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.CVE-2025-52221 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Mailercloud – Integrate webforms and synchronize website contacts: Missing AuthorizationCVE-2026-39713 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
- Product
- Mailercloud – Integrate webforms and synchronize website contacts
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Mailercloud – Integrate webforms and synchronize website contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026leadlovers forms: Missing AuthorizationCVE-2026-39657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.
- Product
- leadlovers forms
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update leadlovers forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Magic Conversation For Gravity Forms: Stored Cross-Site ScriptingCVE-2026-1396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magic Conversation For Gravity Forms
- Affected
- up to 3.0.97
- What to do
- Affects up to 3.0.97. Update Magic Conversation For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Everest Forms: PHP Object InjectionCVE-2026-3296 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
- Product
- Everest Forms
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Gravity Forms: Reflected Cross-Site ScriptingCVE-2026-4406 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in all versions up to, and including, 2.9.30. This is due to the `GFCommon::send_json()` method outputting JSON-encoded data wrapped in HTML comment delimiters using `echo` and `wp_die()`, which serves the response with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets within JSON string values, allowing injected HTML/script tags in `form_ids` array values to be parsed and executed by the browser. The required `config_nonce` is generated with `wp_create_nonce('gform_config_ajax')` and is publicly embedded on every page that renders a Gravity Forms form, making it identical for all unauthenticated visitors within the same 12-hour nonce tick. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability cannot be exploited against users who are authenticated on the target system, but could be used
- Product
- Gravity Forms
- Affected
- up to 2.9.30
- What to do
- Affects up to 2.9.30. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.complugins.trac.wordpress.org
Apr 7, 2026Gravity Forms: Stored Cross-Site ScriptingCVE-2026-4394 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all versions up to, and including, 2.9.30. This is due to the `get_value_entry_detail()` method in the `GF_Field_CreditCard` class outputting the card type value without escaping, combined with `get_value_save_entry()` accepting and storing unsanitized user input for the `input_<id>.4` parameter. The Card Type field is not rendered on the frontend form (it is normally derived from the card number), but the backend submission parser blindly accepts it if included in the POST request. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the form entry in the WordPress dashboard.
- Product
- Gravity Forms
- Affected
- up to 2.9.30
- What to do
- Affects up to 2.9.30. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.complugins.trac.wordpress.org
Apr 7, 2026Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.CVE-2026-31789 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgCritical 9.8
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS mod
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.CVE-2026-4931 · Other software · Marginal · reported by cret@cert.orgHigh 8.6
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
- Product
- Marginal Smart Contract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Ninja Forms - File Uploads: Arbitrary file uploadsCVE-2026-0740 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
- Product
- Ninja Forms - File Uploads
- Affected
- up to 3.3.26
- What to do
- Affects up to 3.3.26. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordninjaforms.comwordfence.com
Apr 4, 2026Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms.CVE-2016-20054 · Other software · nodcms · reported by VulnCheckMedium 5.3
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
- Product
- nodCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 31, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Insecure Direct Object ReferenceCVE-2026-3139 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 3.15.5
- What to do
- Affects up to 3.15.5. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 30, 2026Everest Forms Pro: Remote Code ExecutionCVE-2026-3300 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
- Product
- Everest Forms Pro
- Affected
- up to 1.9.12
- What to do
- Affects up to 1.9.12. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordeverestforms.netplugins.trac.wordpress.org
Mar 28, 2026Ninja Forms - The Contact Form Builder That Grows With You: Sensitive Information ExposureCVE-2026-1307 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to an authorization token to view form submissions for arbitrary forms, which could potentially contain sensitive information.
- Product
- Ninja Forms - The Contact Form Builder That Grows With You
- Affected
- up to 3.14.1
- What to do
- Affects up to 3.14.1. Update Ninja Forms - The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 27, 2026SureForms – Contact Form, Payment Form & Other Custom Form Builder: Payment Amount BypassCVE-2026-4987 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.
- Product
- SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update SureForms – Contact Form, Payment Form & Other Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 27, 2026OS Command Injection vulnerability in NEC Platforms, Ltd.CVE-2026-4622 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comHigh 7.1
OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.
- Product
- Aterm WG2600HS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Hidden Functionality vulnerability in NEC Platforms, Ltd.CVE-2026-4621 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comMedium 6.3
Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.
- Product
- Aterm W1200EX(-MS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026OS Command Injection vulnerability in NEC Platforms, Ltd.CVE-2026-4620 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comHigh 7.1
OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.
- Product
- Aterm WX1500HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Path Traversal vulnerability in NEC Platforms, Ltd.CVE-2026-4619 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comMedium 6
Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.
- Product
- Aterm WX3600HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Missing Authorization vulnerability in NEC Platforms, Ltd.CVE-2026-4309 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comMedium 6.3
Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via network.
- Product
- Aterm W1200EX(-MS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026FormLift for Infusionsoft Web Forms: Missing AuthorizationCVE-2026-4281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.
- Product
- FormLift for Infusionsoft Web Forms
- Affected
- up to 7.5.21
- What to do
- Affects up to 7.5.21. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Missing AuthorizationCVE-2026-32527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.5.
- Product
- WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026weForms: Deserialization of Untrusted DataCVE-2026-32484 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
- Product
- weForms
- Affected
- up to 1.6.26
- What to do
- Affects up to 1.6.26. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: Missing AuthorizationCVE-2026-25430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.
- Product
- Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Contact Form by WPForms: Insertion of Sensitive Information Into Sent DataCVE-2026-25339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.
- Product
- Contact Form by WPForms
- Affected
- up to 1.9.8.7
- What to do
- Affects up to 1.9.8.7. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2026-24363 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.
- Product
- WP Cost Estimation & Payment Forms Builder
- What to do
- Update WP Cost Estimation & Payment Forms Builder to the newest version.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-23636 · Other software · kiteworks · reported by GitHubMedium 5.5
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-23635 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-24750 · Other software · kiteworks · reported by GitHubHigh 7.6
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026Integration with Hubspot Forms: Stored Cross-Site ScriptingCVE-2026-1908 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Integration with Hubspot Forms
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Integration with Hubspot Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026The Contact Form, Survey, Quiz & Popup Form Builder – ARForms: Arbitrary shortcode executionCVE-2024-13785 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Contact Form, Survey, Quiz & Popup Form Builder – ARForms
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update The Contact Form, Survey, Quiz & Popup Form Builder – ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Mar 20, 2026Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-31926 · Other software · IGL-Technologies · reported by ics-cert@hq.dhs.govMedium 6.9
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
- Product
- eParking.fi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-28204 · Other software · CTEK · reported by ics-cert@hq.dhs.govMedium 6.9
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
- Product
- Chargeportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Kali Forms: Remote Code ExecutionCVE-2026-3584 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Kali Forms
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026Stirling-PDF is a locally hosted web application that performs various operations on PDF files.CVE-2026-27625 · Other software · Stirling-Tools · reported by GitHubHigh 8.1
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.
- Product
- Stirling-PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Everest Forms Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27070 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue affects Everest Forms Pro: from n/a through 1.9.10.
- Product
- Everest Forms Pro
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.