Unknown Drop vulnerabilities

• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action CVE-2026-106649 6.8 MediumNovember 4, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing CVE-2026-107343 4.3 MediumNovember 1, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure CVE-2026-107342 4.3 MediumNovember 1, 2026
• unknown price drop alert for woo commerce Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product CVE-2026-87770 8.6 HighSeptember 18, 2026
• glenwpcoder drag and drop multiple file upload for contact form 7 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass CVE-2026-18781 8.1 HighAugust 21, 2026
• glenwpcoder drag and drop multiple file upload for contact form 7 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting CVE-2026-14325 3.5 LowAugust 21, 2026
• glenwpcoder drag and drop multiple file upload for woocommerce Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle CVE-2026-16054 9.1 CriticalAugust 6, 2026
• unknown easy integration for dropbox Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX CVE-2026-15958 9.3 CriticalAugust 4, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR CVE-2026-11580 5.5 MediumJuly 15, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.17 - Unauthenticated Media Upload CVE-2026-11579 5.3 MediumJuly 15, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption CVE-2026-11581 5.9 MediumJune 30, 2026
• glen don mongaya drag and drop multiple file upload – contact form 7 WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-49055 7.1 HighJune 15, 2026
• kaliforms kali forms, unknown contact form builder with drag & drop for wordpress +1 more Kali Forms < 2.4.3 - Contributor+ Stored XSS CVE-2025-3201 5.9 MediumMay 16, 2025
• super-forms super forms, unknown super forms - drag & drop form builder +1 more Superforms < 6.0.4 - Reflected Cross-Site Scripting CVE-2022-0402 6.1 MediumJanuary 16, 2024
• ninjaforms ninja forms, saturday drive ninja forms contact form – the drag and drop form builder for wordpress +1 more WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack CVE-2023-35909 5.3 MediumDecember 7, 2023
• funnelforms free, unknown interactive contact form and multi step form builder with drag & drop editor +1 more Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF CVE-2023-5990 6.5 MediumDecember 4, 2023
• glenwpcoder drag and drop multiple file upload for woocommerce, codedropz drag and drop multiple file uploader +1 more Drag and Drop Multiple File Upload < 1.1.1 - Unauthenticated Stored Cross-Site Scripting CVE-2023-4821 5.4 MediumOctober 16, 2023
• funnelforms, unknown interactive contact form and multi step form builder with drag & drop editor +1 more Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting CVE-2023-4950 6.1 MediumOctober 16, 2023
• ajaydsouza connections reloaded, archimidismertzanos atlast business, fashionable store +47 more +49 more Multiple Themes - Reflected XSS CVE-2023-2813 6.1 MediumSeptember 4, 2023
• king-theme page builder kingcomposer, kingthemes page builder: kingcomposer – free drag and drop page builder by king-theme +1 more Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting CVE-2020-36709 5.5 MediumJune 7, 2023
• king-theme page builder king composer, kingthemes page builder: kingcomposer – free drag and drop page builder by king-theme +1 more Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload CVE-2020-36701 8.8 HighJune 7, 2023
• king-theme page builder kingcomposer, kingthemes page builder: kingcomposer – free drag and drop page builder by king-theme +1 more Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control CVE-2020-36700 8.8 HighJune 7, 2023
• glen don l. mongaya drag and drop multiple file upload – contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 more WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-45364 5.4 MediumMay 24, 2023
• unknown drag and drop multiple file upload pro - contact form 7 standard, drag and drop multiple file upload pro - contact form 7 with remote storage integrations, codedropz drag and drop multiple file upload - contact form 7 +2 more Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting CVE-2023-1282 6.1 MediumApril 17, 2023
• unknown drag & drop sales funnel builder for wordpress, getwpfunnels drag \& drop sales funnel builder +1 more WPFunnels < 2.6.9 - Contributor+ Stored XSS CVE-2023-0173 5.4 MediumFebruary 6, 2023
• opmc woocommerce dropshipping WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi CVE-2022-3481 9.8 CriticalNovember 7, 2022
• 10web form maker, form maker by 10web – mobile-friendly drag & drop contact form builder +1 more Form Maker by 10Web < 1.15.6 - Admin+ SQLI CVE-2022-3300 7.2 HighOctober 25, 2022
• codedropz drag and drop multiple file upload - contact form 7, unknown drag and drop multiple file upload – contact form 7 +1 more Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass CVE-2022-3282 4.3 MediumOctober 17, 2022
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more NinjaForms < 3.6.13 - Admin+ PHP Objection Injection CVE-2022-2903 7.2 HighSeptember 26, 2022
• weformspro weforms, boldgrid weforms – easy drag & drop contact form builder for wordpress +1 more weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting CVE-2022-2395 4.8 MediumAugust 8, 2022
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import CVE-2021-25066 4.8 MediumJuly 4, 2022
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting CVE-2021-25056 4.8 MediumJuly 4, 2022
• unknown drag & drop builder, human face detector, pre-built templates, spam protection, user email notifications & more!, pieforms drag \& drop builder +1 more WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting CVE-2022-1569 4.8 MediumJune 6, 2022
• 10web form maker, form maker by 10web – mobile-friendly drag & drop contact form builder +1 more Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting CVE-2022-1564 4.8 MediumMay 30, 2022
• dropdown menu widget project menu widget, unknown dropdown menu widget +1 more Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS CVE-2021-25113 5.4 MediumApril 4, 2022
• king-theme kingcomposer, unknown page builder: kingcomposer – free drag and drop page builder by king-theme +1 more KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting CVE-2021-25048 5.4 MediumApril 4, 2022
• codedropz drag and drop multiple file upload - contact form 7, unknown drag and drop multiple file upload – contact form 7 +1 more Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS CVE-2022-0595 EPSS 13.6% 5.4 MediumMarch 28, 2022
• king-theme kingcomposer, unknown page builder: kingcomposer – free drag and drop page builder by king-theme +1 more Page Builder KingComposer <= 2.9.6 - Open Redirect CVE-2022-0165 Public exploit 6.1 MediumMarch 14, 2022
• unknown easy drag and drop all import : wp ultimate csv importer, smackcoders import all pages\, post types\, products\, orders\, and users as xml \& csv +1 more WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting CVE-2022-0360 4.8 MediumFebruary 28, 2022
• wpeverest contact form, unknown contact forms – drag & drop contact form builder +1 more Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read CVE-2021-24689 4.9 MediumFebruary 28, 2022
• wpeverest everest forms, unknown contact form, drag and drop form builder for wordpress – everest forms +1 more Everest Forms < 1.8.0 - Reflected Cross-Site Scripting CVE-2021-24907 6.1 MediumDecember 21, 2021
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.6.4 - Admin+ SQL Injection CVE-2021-24889 7.2 HighNovember 29, 2021
• ninjaforms contact form, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site Scripting CVE-2021-24381 4.8 MediumOctober 25, 2021
• 10web form maker by 10web – mobile-friendly drag & drop contact form builder, form maker +1 more Form Maker < 1.13.60 - Authenticated Stored XSS CVE-2021-24526 5.4 MediumAugust 16, 2021
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection CVE-2021-24166 5.4 MediumApril 5, 2021
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.4.34 - Administrator Open Redirect CVE-2021-24165 6.1 MediumApril 5, 2021
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure CVE-2021-24164 4.3 MediumApril 5, 2021
• ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure CVE-2021-24163 8.8 HighApril 5, 2021